Kernel privilege escalation: CVE-2026-31431 (Copy Fail)

A Linux kernel flaw lets a local unprivileged user gain root. Check whether your server is exposed, apply the mitigation, then update the kernel.

Audience: WebGee VPS and dedicated server customers running Linux.

CVE-2026-31431, publicised as Copy Fail, allows a local unprivileged user to escalate to root on affected systems.

"Local" is less reassuring than it sounds. Any code running as a non-root user — a vulnerable CMS, a compromised plugin, a web shell dropped through an outdated WordPress site — can be chained into full control of the server. Treat it as urgent.

What to do

Check whether you are exposed (below).
Apply the short-term mitigation if you are, blocking the algif_aead module.
Update your kernel when your distribution ships a fixed package, and reboot — the mitigation is a stopgap, not a fix.

Shared, reseller and Premium hosting customers need do nothing. WebGee patches those servers.

Check your server

WebGee provides a script that reports whether your running kernel appears patched, whether the module is present or loaded, and can apply the mitigation for you.

As root:

wget -qO- https://security.webgee.com/scripts/copyfail-check.sh | bash

Or by hand:

# Your running kernel
uname -r

# Is the affected module loaded?
lsmod | grep algif_aead

Compare your kernel version against your distribution's advisory — the fixed version differs between AlmaLinux, Debian, Ubuntu and Rocky.

Apply the mitigation

Blocks the module from loading, and unloads it if it is loaded and not in use:

echo "install algif_aead /bin/true" > /etc/modprobe.d/blacklist-algif_aead.conf
modprobe -r algif_aead

The first line survives reboots. The second takes effect immediately, and fails harmlessly if something is using the module — in which case a reboot applies it.

algif_aead exposes kernel crypto to userspace. Almost nothing uses it, but some VPN and disk-encryption tooling does. Test that your services still work after applying this, particularly if you run IPsec or anything using the kernel crypto API.

Then update the kernel

The mitigation blocks one route. Updating fixes the flaw:

# Debian / Ubuntu
apt update && apt upgrade

# AlmaLinux / Rocky
dnf upgrade

reboot

A kernel update does nothing until you reboot. The running kernel is the one loaded at boot, so a server that has been updated but not restarted is still exposed. Confirm with uname -r afterwards.

Once running a fixed kernel, you can remove the mitigation file if the module is needed:

rm /etc/modprobe.d/blacklist-algif_aead.conf

Reduce your exposure regardless

This flaw needs local code execution to exploit, so the same measures that prevent that help here:

Update applications, particularly WordPress plugins — see Clean malware from your website.
Use SSH keys rather than passwords — see Add an SSH key.
Remove unused accounts and services.

Managed customers

Servers on a management plan are patched by WebGee — see What server management includes. Unmanaged servers are yours to update, and nobody else will.