Kaspersky has released an analysis report on the Linux kernel vulnerability 'Copy Fail (CVE-2026-31431)' and warned that it may be possible to hijack root privileges without modifying files. The vulnerability is characterized by the fact that it operates by modifying only the memory cache while leaving files on disk intact, making it difficult to detect by existing file integrity checks or endpoint security systems.

In a report released in Seoul on May 7, Kaspersky explained that Copy Fail stems from a buffer processing error in the Linux kernel cryptographic subsystem. This vulnerability can be exploited by combining the AF_ALG interface with the splice() system call, allowing an attacker to alter the behavior of setuid executables by manipulating some values in memory.

If the attack is successful, files stored on the disk remain unchanged, but modified code running in memory upon execution can lead to root privileges. For this reason, it is difficult to detect traces of the attack using security methods that assess threats based on whether files have been modified.

However, this vulnerability is not the type that is exploited remotely on its own. There is a high probability that an attacker will leverage this during the privilege escalation phase after already securing internal system access. Particular caution is required in container environments, as the impact can extend beyond container boundaries depending on the host kernel module access conditions.

Kernel updates are the priority for response. However, immediate application may be difficult in production environments as reboots and prior verification are often required. In such cases, behavior-based detection utilizing EDR and SIEM must be performed in parallel with the disabling of vulnerable modules.

Kaspersky identified the flow of privilege escalation commands following shell execution in a Python process, abnormal UID changes, and system calls after SUID binary access as key detection indicators. This case demonstrates that it is difficult to sufficiently identify memory-centric attacks using file-based detection alone.