About Linux Sudo Access Exploit

[sglbl]

3 days ago a new exploit was shared by copy.fail that effects all the linux distros after 2017.

This script makes sudo command or knowing the password unnecessary by manipulating kernel socket.

Source code (732 byte python script, it requires only an unprivileged local user account and standard library, no network access, no kernel debugging features, not even pre-installed primitives.):

GitHub - theori-io/copy-fail-CVE-2026-31431

I tested it with the command shown on my Linux 6.17.0-22 and it directly elevated to sudo access without password.

Details:

@AZorin @zorink Is there any plan for a patch update to make Zorin more secure?

[Forpli]

Take a look here at post #4, an update came:

CVE-2026-31431 (Copy Fail) Patch Status for Zorin OS 18.1

Hello community, I have Zorin OS 18.1 (kernel 6.17) and I'm concerned about the recent Copy Fail (CVE-2026-31431) Linux kernel vulnerability that allows local privilege escalation to root. Questions: Is a official patch/kernel update being worked on for Zorin OS 18.1? When can we expect the patch release (Linux 6.18.22+ or backport)? Are there currently available HWE kernels with the fix in Zorin repositories? For now, I've temporarily blacklisted the algif_aead module, but I'm waiting for…

Did you try it after that update?

[sglbl]

Since Ubuntu is down at the most important time, I cannot upgrade from 6.17 to a newer version. Also upgrading my kernel crashed my system twice until now on zorin os. (I had to downgrade from nvidia v. 580 to 535)

[Forpli]

It isn't a kernel upgrade. But yes, at the moment there seem to be problems with the servers. I got the update yesterday and have the file now on my Zorin 17 Lite system (at etc/modprobe.d/disable-algif_aead.conf)

[Ponce-De-Leon]

Maybe try it again now with the Terminal. I see at the Moment that only the Launchpad Sources are not available but the Ubuntu Archive Sources seems to work now. So, you would get Updates from the Launchpad Sources which would mean Updates from the zorin OS Sources but at least Ubuntu Updates could work.

[sglbl]

It's the same error unfortunately

[Ponce-De-Leon]

Well, when You want at least close the CopyFail Thing manually, You could do that. You would have to create a File called disable-algif_aead.conf in /etc/modprobe.d/

It should look like here shown:

CVE-2026-31431 (Copy Fail) Patch Status for Zorin OS 18.1

UPDATE: I got today an Update over the Software Updater. Besides Kernel Updates came an Update for kmod/libkmod which is related to this Security Vulnerability. So, there doesn't come a Kernel Patch to say that clear. The Update makes that what the Explorer of the Security Issue already delivered: It disables the problematic Module. When updated, You can check that in the Directory /etc/modprobe.d/ that there is a File called disable-algif_aead.conf Here some Pictures to show it: [Bildschir…

[sglbl]

@sglbl

Also upgrading my kernel crashed my system twice until now on zorin os.

Today finally canonical servers worked so I made the upgrade.
But it changed my default windowing from X to Wayland. Why?
I realized the change when flameshot didn't work and screen flashed and windows had white border and so many weird things...
When I logged out, I saw that now it says this

(Before: There were "Zorin Desktop" and "Zorin Desktop on Wayland" options since I installed Zorin with Nvidia Drivers, and Zorin Desktop was the X11/Xorg one. Now it's the opposite)
So I had to change to Xorg again.

[swarfendor437]

Hi. Because Zorin updates come from the affected ppa.launchpad.net, the servers will have triggered system-wide updates. That is why your cog settings have changed.

Other distributions (except KDE) usually have X11 (xorg) the default (or did). Personally it would be great if Wayland were dropped in favour of XLibre. Thankfully the two distributions I use, 1 has already adopted XLibre, the other is going to.