Introduction: What Is This All About?

Imagine you have a locked safe in your office. Only you have the key. One day, you discover that someone figured out a clever trick — not breaking the lock, but tricking the safe into opening itself because of a small mistake in how it was built. That is exactly what a software vulnerability is.

CVE-2026-31431, nicknamed “Copy Fail,” is one such mistake found deep inside the Linux operating system — the software that runs most servers, cloud systems, and even Android phones. This flaw allows a regular, unprivileged user (someone with no special permissions) to suddenly gain full control over the entire computer or server. In cybersecurity, this is called Local Privilege Escalation (LPE).

The name “Copy Fail” comes from the way this bug works — something goes wrong when the system tries to copy or handle certain internal messages, and that failure gives an attacker an unexpected opening.

This essay will walk you through, in plain English, how this vulnerability works, how attackers use it, and — most importantly — how you can detect and protect your systems using tools from Kaspersky and other common-sense monitoring techniques.

Part 1: Understanding the Problem — What Makes Copy Fail Dangerous?

What Does “Privilege Escalation” Mean?

On any computer, there are two main types of users:

Regular users — can only access their own files and run basic programs.
Root (or Administrator) — can do anything: install software, change system settings, read every file, and even delete everything.

Normally, moving from “regular user” to “root” requires a password or a special command like sudo. But with Copy Fail, an attacker can skip all that. They run one simple program, and suddenly they become root without ever typing a password.

How Does It Actually Work? (Simplified)

Inside Linux, different parts of the system talk to each other using messages. One special way of sending messages is called a netlink socket (specifically type AF_NETLINK with a value of 0x26). Think of it like a private telephone line between system components.

The Copy Fail vulnerability happens when an attacker creates this special socket in a certain tricky way. The system gets confused, and instead of saying “you’re not allowed to do that,” it accidentally hands over full control. It’s like a bank teller giving a stranger the keys to the vault because the stranger asked in a confusing tone of voice.

Part 2: How Attackers Use This Vulnerability

The Original Proof of Concept (Python)

When security researchers first discovered Copy Fail, they wrote a simple program in Python to prove the bug exists. This program:

Creates the special AF_NETLINK socket.
Sends a carefully crafted sequence of messages.
Forces the system to run a shell — but now that shell has root powers.

Because Python is easy to write and run, this was the first weapon attackers started using.

Newer Versions in Go and Rust

Here is where things get more complicated. Attackers quickly realized that a single Python script is easy for security tools to detect. So they rewrote the exploit in Go and Rust — two programming languages that produce faster, harder‑to‑analyze programs.

Why does this matter? Because these different versions may:

Use different sequences of system calls (the way a program asks the operating system for something).
Use tricks to hide what they are doing.
Change the order of actions to bypass simple detection rules.

In other words, you cannot just look for one specific pattern. You have to watch for the behavior — the strange things the program does — rather than the exact code it runs.

Part 3: Detecting Copy Fail — What to Look For

Detecting this vulnerability is like being a security guard who doesn’t just look for one disguise but watches for suspicious actions: someone walking toward a door they shouldn’t approach, or trying a handle when nobody is looking.

Below are the most reliable methods to spot Copy Fail in action.

Method 1: Watching System Calls (The Socket Rule)

Remember that special AF_NETLINK socket (type 0x26)? One strong detection method is to monitor anytime a program tries to create that socket but is not running as root.

In technical monitoring rules, this looks like:

On 64‑bit systems: watch for socket calls with a0=0x26 where the user is not UID 0.
On 32‑bit systems: do the same.

If a non‑root program is trying to create that specific socket, it is highly suspicious. Normal programs almost never do this.

Method 2: Watching Process Chains — The Parent–Child Relationship

This is one of the most effective and clever detection methods.

Here is what a normal process looks like:

You type a command → the shell (like bash) starts a program → that program may start another program.
If privileges change, it usually happens through a clear command like sudo or su, and those leave traces.

Here is what Copy Fail looks like instead:

A Python process (running as a regular user) launches a shell process.
That shell process is suddenly running as root — but there was no sudo or su command anywhere.
The shell then tries to run su or other special system binaries (called SUID binaries) to keep those root privileges.

This is a huge red flag. It means something invisible boosted the program’s power.

What to monitor:

A shell process, not running as root, launched from a Python process, whose arguments contain an attempt to execute su or any other SUID binary.

Kaspersky detects this with a rule named: possible_lpe_by_python

Method 3: Watching Command Lines — The “sh -c — su” Pattern

Sometimes the attack leaves a very specific fingerprint in the command line. For Copy Fail, researchers noticed a recurring pattern:

sh -c -- su

Let’s break this down:

sh — starts a new shell.
-c — tells the shell to run a command.
-- — means “what follows is the actual command, not an option.”
su — the command to switch users (usually to root).

When you see a regular user running sh -c -- su without ever typing a password, something is almost certainly wrong. This pattern appears in many Copy Fail exploit attempts.

Kaspersky detects this with a rule named: possible_copy_fail_cve_2026_31431

Method 4: Watching UID Changes Without Proper Authorization

This is a more general, powerful detection method that catches not just Copy Fail but many other privilege escalation attacks.

What to monitor:

Any time a process chain shows a change in User ID (UID) — meaning the numeric ID that represents a user — but there is no corresponding setuid system call or sudo command in the logs.

Specifically, look for:

Parent process runs as UID 1000 (a regular user).
Child process runs as UID 0 (root).
The path to the executable is unusual — for example, /tmp/unknown_binary instead of /usr/bin/bash.

This pattern strongly suggests an exploit, not a normal administrative action.

Kaspersky experts are currently finalizing a universal detection method based exactly on this principle — catching UID anomalies regardless of the specific exploit code.

Part 4: Protecting Your Systems — What Tools to Use

For Traditional Servers and Workstations

If you use Kaspersky SIEM (Security Information and Event Management), you can download a ready‑made detection package from the Kaspersky product repository. The package name is:

[OOTB] CopyFail (CVE-2026-31431) package — ENG

This package contains all the rules described above, pre‑configured and ready to deploy.

For Endpoint Detection (Individual Computers and Servers)

Kaspersky EDR Expert (Endpoint Detection and Response) actively detects Copy Fail attacks using:

The possible_lpe_by_python rule (for Python‑based exploits).
The possible_copy_fail_cve_2026_31431 rule (for command‑line patterns).

EDR Expert watches not just one file but the entire behavior of programs — what they launch, what system calls they make, and what files they touch.

For Containers (Docker, Kubernetes)

Modern companies often run software inside containers — lightweight, isolated environments. The Copy Fail vulnerability affects the host’s Linux kernel, so if an attacker breaks out of a container using this flaw, they can take over the entire physical server.

Kaspersky Container Security (KCS) has been updated to:

Detect vulnerable Linux kernel versions in your container environments.
Alert you if a containerized application attempts to exploit CVE-2026-31431.

If you run Docker or Kubernetes, enabling KCS should be a priority.

Part 5: What Kaspersky Is Doing Next

The security landscape never stands still. As attackers write new versions of the Copy Fail exploit (in Go, Rust, or other languages), detection must evolve.

Kaspersky experts are currently finalizing a universal detection method — a single rule or set of rules that will detect any attempt to exploit Copy Fail, regardless of the programming language or obfuscation technique used. This method focuses on the core behavior of the vulnerability: the way it manipulates netlink sockets and bypasses normal privilege checks.

Once ready, this universal method will be rolled into all Kaspersky products (SIEM, EDR Expert, Container Security) automatically.

Part 6: Practical Steps You Can Take Today

You don’t have to wait for a perfect solution. Here is what you can do right now:

Update your Linux kernel — Check if your distribution has released a patch for CVE-2026-31431. Apply it immediately.
Enable monitoring for UID changes — Even simple scripts that log when a non‑root process spawns a root process can catch many attacks.
Watch for sh -c -- su patterns — Use grep or your log management tool to search for this exact string in process creation logs.
If you use Kaspersky products — Download and deploy the Copy Fail detection package from the repository.
For container users — Run a scan with KCS to identify vulnerable kernel versions.

Conclusion: Stay Vigilant, But Don’t Panic

CVE-2026-31431 (Copy Fail) is a serious vulnerability because it gives regular users root access without a password. Attackers are actively writing new versions in Python, Go, and Rust to evade detection.

However, the good news is that detection is absolutely possible. By watching for:

Unusual socket creation (the 0x26 netlink socket),
Suspicious process chains (Python launching a root shell),
Telltale command lines (sh -c -- su),
And unexpected UID changes without proper authorization,

you can catch this attack before it causes damage.

Kaspersky has already released detection rules for SIEM, EDR Expert, and Container Security. A universal detection method is on the way.

In cybersecurity, the goal is not to be perfect — it is to be watchful. Copy Fail can be stopped. You now know how.

Stay safe, stay updated, and always question unexpected privilege chang