Copy Fail (CVE-2026-31431)

A critical kernel privilege escalation that leaves no trace on disk — and how it works It started with a blog post. On April 29, 2026, Theori's research platform Xint Code quietly dropped a URL: copy.fail . Within hours, security teams across the industry were scrambling. A 732-byte Python script — shorter than most .gitignore files — was rooting every major Linux distribution in existence. No race conditions. No kernel symbols. No ASLR bypass. Just a logic bug hiding in the Linux kernel since 2