It's called "Copy Fail". A Linux kernel vulnerability discovered by a Korean researcher using artificial intelligence. It affects every Linux server since 2017. A 732-byte Python script is all it takes to prove that anyone with access to a container on a shared server can become root on the entire machine — in seconds, leaving no traces on disk.
Public disclosure: April 29, 2026. Sixteen hours later it was already on Dread, the dark web's Reddit. Crypto exchanges — which run your funds on Kubernetes clusters made up of hundreds of containers — haven't finished deploying the patch yet.
The question is simple: is your exchange safe? The answer, right now, is: it depends on how quickly they updated their kernel.
What Is CVE-2026-31431 "Copy Fail" — Explained Without Jargon
The problem is in a kernel module called authencesn. Through a sequence of operations (AF_ALG -> splice()), an ordinary unprivileged user can write 4 bytes into a memory area they shouldn't touch: the page cache — the in-memory version of any file on the system. Pointing that write at the su binary yields a root shell — without ever touching the file on disk.
What makes this different from almost any other vulnerability:
- 🎯 100% reliable — no race condition, always works
- 👣 Zero disk traces — the file is never touched, forensics find everything clean
- 📦 732 bytes of pure Python — standard library, no external dependencies
- 🖥 Portable — same script on Ubuntu, Amazon Linux, RHEL, SUSE
- 📅 Present since 2017 — nearly a decade in the kernel, unnoticed
Discovered by Taeyang Lee (Xint Code/Theori) using AI-assisted analysis in roughly one hour. PoC on GitHub. Official site: copy.fail.
How It Hits Crypto Exchanges — Kubernetes and Container Escape
All major crypto exchanges run on Kubernetes. The page cache is shared at host level — from inside one container, exploiting this vulnerability means escaping to root on the entire host, with access to all other containers on the node, including those holding private wallet keys.
Realistic attack scenario on an exchange:
- Attacker gains container access (web RCE, insider threat, supply chain attack)
- Runs the 732-byte script — takes seconds
- Becomes root on the Kubernetes host
- Accesses all secrets, containers, cryptographic keys on the node
- Drains wallets
Are Exchanges Vulnerable? State of Patches
Patch merged to Linux mainline: April 1, 2026 (commit a664bf3d603d). Safe kernel versions: 6.18.22+, 6.19.12+, 7.0+.
Confirmed vulnerable: Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, SUSE 16. Exchanges typically update kernels every 4-8 weeks. Many production servers are still running vulnerable versions today.
The First Major Linux Vulnerability Discovered by AI
CVE-2026-31431 was identified by Taeyang Lee (Xint Code/Theori) using an AI analysis system in roughly an hour.
"I hate AI slop but this is 100% a real and severe vulnerability. This is effectively evidence that AI vulnerability detection is becoming a real threat. We may see a third wave of vulnerabilities as people start analyzing the kernel with AI." — Dread user, 18k points, 8 years
Theori confirms the same AI scan found additional high-severity kernel bugs currently in coordinated disclosure. This is the beginning of a new era in security research.
What to Do Now — How to Protect Your Funds
Exchange users:
- ✅ Diversify: don't hold all funds on one exchange
- ✅ Self-custody: for significant amounts, use a hardware wallet (Ledger, Trezor, Coldcard)
- ✅ Monitor communications from your exchange in the coming hours/days
- ✅ Strong 2FA: use a hardware key (YubiKey) or TOTP app, never SMS
Exchange operators:
- 🚨 Update immediately to kernel >= 6.18.22, 6.19.12 or 7.0
- 🚨 Verify with
uname -ron all cluster nodes - 🚨 Check
lsmod | grep authencesn
Frequently Asked Questions
Can CVE-2026-31431 be exploited remotely?
No. It requires local code execution as a starting point. In Kubernetes environments, "local" includes any container on the same physical host.
Are my exchange funds at immediate risk?
No confirmed ongoing attack. The risk is potential: an attacker already with container access on a vulnerable exchange could escalate privileges using this technique.
How do I know if my exchange has patched?
No public list exists yet. Contact your exchange directly and monitor their security blog for CVE-2026-31431 communications.
Published: April 30, 2026 | Author: Segugio
Related: Best Exchanges 2026 | MiCA Compliance 2026