About Linux Sudo Access Exploit

[sglbl]

3 days ago a new exploit was shared by copy.fail that effects all the linux distros after 2017.

This script makes sudo command or knowing the password unnecessary by manipulating kernel socket.

Source code (732 byte python script, it requires only an unprivileged local user account and standard library, no network access, no kernel debugging features, not even pre-installed primitives.):

GitHub - theori-io/copy-fail-CVE-2026-31431

I tested it with the command shown on my Linux 6.17.0-22 and it directly elevated to sudo access without password.

Details:

@AZorin @zorink Is there any plan for a patch update to make Zorin more secure?

[Forpli]

Take a look here at post #4, an update came:

CVE-2026-31431 (Copy Fail) Patch Status for Zorin OS 18.1

Hello community, I have Zorin OS 18.1 (kernel 6.17) and I'm concerned about the recent Copy Fail (CVE-2026-31431) Linux kernel vulnerability that allows local privilege escalation to root. Questions: Is a official patch/kernel update being worked on for Zorin OS 18.1? When can we expect the patch release (Linux 6.18.22+ or backport)? Are there currently available HWE kernels with the fix in Zorin repositories? For now, I've temporarily blacklisted the algif_aead module, but I'm waiting for…

Did you try it after that update?

[sglbl]

Since Ubuntu is down at the most important time, I cannot upgrade from 6.17 to a newer version. Also upgrading my kernel crashed my system twice until now on zorin os. (I had to downgrade from nvidia v. 580 to 535)

[Forpli]

It isn't a kernel upgrade. But yes, at the moment there seem to be problems with the servers. I got the update yesterday and have the file now on my Zorin 17 Lite system (at etc/modprobe.d/disable-algif_aead.conf)