‘A single 732-byte Python script can be used to obtain root on essentially all Linux distributions shipped since 2017’: Time to update your kernel
A critical security vulnerability dubbed “Copy Fail” has been discovered in Linux distributions, affecting essentially all versions released since 2017. The flaw, designated CVE-2026-31431, allows local users to escalate privileges to root by exploiting a weakness in the kernel’s page cache mechanism. The attack works by writing just four bytes of controlled data into the page cache of any readable file, and requires only a 732-byte Python script—making it remarkably simple to exploit.
The vulnerability was disclosed by security research team Theori and has already been confirmed in active use by threat actors in the wild, according to CISA. This represents an urgent security threat for Linux systems, particularly given the ease of exploitation and widespread impact across distributions released over the past seven years.
For Linux users and system administrators, immediate kernel updates are critical. The high severity rating, combined with the simplicity of the exploit and confirmed active exploitation, makes this a priority security patch. The discovery highlights ongoing security challenges for open-source systems, even as Linux gaming and adoption continue to grow.