Another AI-Assisted Software Scan Yields 9-Year-Old Linux Bug

With a hunch, and an hour of AI-assisted scanning, cybersecurity researchers identified and then figured out how to exploit a nine-year-old root escalation vulnerability affecting every Linux build since 2017. The vulnerability, which researchers at Xint are calling "Copy Fail," has officially been given the designation CVE-2026-31431. It allows any local user to escalate root by leveraging a logic flaw in the Linux kernel's cryptography system. The flaw allows any unprivileged attacker to write four specific bytes of data to the in-memory copy of a readable file, to essentially piggyback on the program's default root powers. Copy Fail works thanks to a long history of otherwise sensible updates to the Linux kernel over the years — particularly one update from 2017, which was meant to speed up data encryption. Ironically, then, old, unpatched devices are actually in the clear here. Considering the severity of the issue, one might imagine that exploiting it would be complex. Not so — Xint's public proof-of-concept (PoC) exploit code on GitHub runs only 10 lines long. Luckily, a patch is just as freely downloadable. CVE-2026-31431 works equally across all Linux distributions. It requires no funky race conditions. Where most local privilege escalation (LPE) bugs in Linux are probabilistic, Xint noted in its blog post, CVE-2026-31431 works 100% of the time. Because exploitation occurs in temporary memory, it leaves no trace of a crime on the disk, and evidence of the crime will c...