██████╗ ██████╗ ██████╗ ██╗   ██╗    ███████╗ █████╗ ██╗██╗
                    ██╔════╝██╔═══██╗██╔══██╗╚██╗ ██╔╝    ██╔════╝██╔══██╗██║██║
                    ██║     ██║   ██║██████╔╝ ╚████╔╝     █████╗  ███████║██║██║
                    ██║     ██║   ██║██╔═══╝   ╚██╔╝      ██╔══╝  ██╔══██║██║██║
                         ╚██████╗╚██████╔╝██║        ██║       ██║     ██║  ██║██║███████╗
                          ╚═════╝ ╚═════╝ ╚═╝        ╚═╝       ╚═╝     ╚═╝  ╚═╝╚═╝╚══════╝

📖 Table of Contents

🔍 What is Copy Fail?

Copy Fail is a local privilege escalation (LPE) vulnerability disclosed on April 29, 2026, affecting virtually every major Linux distribution running kernels since 2017.

Unprivileged User  ──►  AF_ALG + splice()  ──►  4-byte Page Cache Write  ──►  ROOT

Key Facts at a Glance

Why This Is Dangerous

• 🕵️ Stealthy — Modification lives only in the page cache; the file on disk is never changed. Standard disk forensics will not detect it.
• ⚡ Reliable — Deterministic logic flaw, not a race condition. Exploitation is consistent across environments.
• 🌐 Universal — Affects Ubuntu, RHEL, Amazon Linux, SUSE, Debian — every major distro since 2017.
• ☸️ Cloud/K8s Impact — Can facilitate container escape in Kubernetes workloads and CI/CD runners.
• 🤖 AI-Discovered — Found by Xint Code's AI system with ~1 hour of scan time and a single operator prompt.

🔬 Technical Deep Dive

Root Cause

The vulnerability stems from a buggy in-place optimization introduced in 2017 (commit 72548b093ee3) inside the algif_aead module of the Linux kernel's userspace crypto API (AF_ALG).

AF_ALG (userspace crypto API)
└── algif_aead module
    └── authencesn template  ◄── VULNERABLE
        └── in-place optimization (2017)
            └── req->src == req->dst  ◄── pages from splice() chained into writable dst scatterlist

Attack Flow

Step 1: Open AF_ALG AEAD socket
        socket(AF_ALG, SOCK_SEQPACKET, 0)

Step 2: Send splice() pages referencing target file
        (page cache pages of a privileged binary, e.g. /usr/bin/sudo)

Step 3: Trigger authencesn scratch write
        authencesn uses dst buffer as scratch pad →
        writes 4 controlled bytes PAST the legitimate output region

Step 4: Page cache entry for the target file is now corrupted
        (disk file untouched — only in-memory copy modified)

Step 5: Execute the modified binary → ROOT

Why the Page Cache?

The Linux kernel's page cache backs in-memory copies of files. When a file is read, its pages are cached. The splice() syscall can reference these cached pages directly. By feeding page cache pages into the AF_ALG AEAD scatterlist, the authencesn scratch write lands inside those cached pages, effectively patching the in-memory copy of any readable file — including privileged binaries like sudo, pkexec, or passwd.

The Fix

The upstream fix reverts the flawed 2017 optimization:

# Fixed in commit: a664bf3d603d
git show a664bf3d603d

🖥️ Affected Systems

Linux Kernel Versions

Distribution Matrix

📁 Repository Structure