Security advisory: Copy Fail
A Linux kernel privilege-escalation flaw (Copy Fail) affecting kernel 4.14 and later, with mitigation for your VMs.
This advisory covers CVE-2026-31431 (Copy Fail), a Linux kernel privilege-escalation flaw affecting kernel 4.14 and later. It outlines the vulnerability, our response, and the immediate mitigation you should apply to every Linux VM. No reboot is required.
Summary
CVE-2026-31431, known as Copy Fail, is a Linux kernel vulnerability publicly disclosed on 29 April 2026. It affects Linux kernel version 4.14 and later. It allows an unprivileged local user to escalate privileges to root. A public proof-of-concept exists.
What we're doing
We're aware of this vulnerability and are taking all necessary steps to protect our managed infrastructure. Updated base images with kernel-level protections will be made available. We'll notify you when these are ready.
What you should do now
Apply the mitigation below to your VMs immediately. It requires no reboot and is considered safe for production environments.
Step 1: Apply the immediate mitigation
This step applies to everyone. Run the following on every Linux VM you operate.
sudo modprobe -r algif_aead
echo "blacklist algif_aead" | sudo tee /etc/modprobe.d/algif_aead_blacklist.conf
This removes the exploitable code path from your running kernel.
Step 2: Apply your distribution's kernel patch
This step applies only if you manage your own OS. Patches are available from Ubuntu, Debian, RHEL, SUSE, and Amazon Linux. Apply them through your standard package manager as soon as possible.