A critical kernel privilege escalation that leaves no trace on disk — and how it works It started with a blog post. On April 29, 2026, Theori's research platform Xint Code quietly dropped a URL: copy.fail . Within hours, security teams across the industry were scrambling. A 732-byte Python script — shorter than most .gitignore files — was rooting every major Linux distribution in existence. No race conditions. No kernel symbols. No ASLR bypass. Just a logic bug hiding in the Linux kernel since 2017, waiting to be found. TL;DR for the Busy Reader CVE-2026-31431, nicknamed Copy Fail , is a local privilege escalation (LPE) in the Linux kernel's AF_ALG crypto subsystem. An unprivileged user can: Open a crypto socket (zero privileges required) Splice pages from /usr/bin/su into it Trigger a 4-byte write into the in-memory page cache of that binary Run su — now running attacker shellcode — and get a root shell The file on disk is never touched . No checksums fail. No integrity monitors fire.…