A logical flaw exploitable with 100% certainty across all Linux distributions since 2017; immediate patching recommended.

Identified in just one hour by 'Xint Code,' Theori's proprietary AI-driven code analysis solution.

Theori has discovered a security vulnerability in the Linux operating system that allows for 100% takeover of system privileges.

The newly disclosed vulnerability, dubbed 'CopyFail' (CVE-2026-31431), exploits a logical flaw within the Linux kernel's cryptographic processing. It is considered extremely threatening as it enables an attacker to gain 'root' (the highest level of system authority) using only 732 bytes of code, boasting a 100% success rate across any distribution.

The vulnerability has been confirmed to affect all major mainstream distributions released since 2017, including Ubuntu, Amazon Linux, RHEL, and SUSE. Key characteristics include:

• Direct Memory Cache Manipulation: It directly modifies data temporarily stored in memory (Page Cache) when the system reads files.

• Trace-free Attacks: Because it alters memory data without touching files stored on the physical hard drive, it is nearly impossible to detect using traditional file inspection tools or digital forensics.

• Neutralization of Container Boundaries: In cloud environments, even if individual users or services operate in isolated spaces (containers), an attacker can seize control of the entire server by targeting the operating system’s shared memory area.

Most notably, this vulnerability remained undetected by security experts and the global open-source community for 9 years. It was finally uncovered by 'Xint Code,' an AI-driven code analysis solution developed by Theori. By combining the expertise of Theori’s research team with Xint Code’s high-speed processing, the team successfully identified a subtle logic error—hidden for nearly a decade—in just one hour. This achievement demonstrates the critical role of AI-powered security design in defending modern infrastructure.

"Immediate Patching Recommended"

Brain Sejun Pak, CEO of Theori, stated, "CopyFail serves as a warning of how easily even the most trusted operating system designs can be breached. In an era where attackers leverage AI, adhering solely to legacy defense systems is dangerous. Radical innovation is urgent to protect our entire infrastructure."

Theori has completed patch development in collaboration with the Linux Kernel security team, and emergency security updates are currently being distributed via major OS vendors. Due to the stealthy nature of the attack, Theori strongly urges all Linux administrators to immediately apply the latest security patch (incorporating commit a664bf3d603d) to prevent potentially catastrophic damage.

Detailed countermeasures and technical analysis can be found on the official Xint Blog.

https://xint.io/blog/copy-fail-linux-distributions