A security vulnerability known as Copy Fail has been disclosed in the Linux kernel and is tracked as CVE-2026-31431. It is a local privilege escalation vulnerability, which means that, under certain circumstances, a regular system user may be able to gain root privileges.
For VPS server owners, this type of flaw is particularly unpleasant. If an attacker manages to gain access to the server as a regular user, a kernel vulnerability like this could help them gain full control of the system.
The vulnerability affects a part of the Linux kernel related to the algif_aead / AF_ALG cryptographic interface and the splice() function. According to security advisories, this is considered a high-severity vulnerability because it may allow local privilege escalation up to root level. The reported CVSS score is 7.8. More... https://copy.fail/
Who is affected?
servers with multiple user accounts, web hosting environments, containers, development servers, or older installations without regular updates may be particularly at risk.
According to the available information, the issue may affect many Linux distributions and kernels used in recent years. AlmaLinux stated that all supported AlmaLinux versions were affected by the vulnerability, while Ubuntu reported that the issue affects Ubuntu releases prior to version 26.04 Resolute.
What we recommend for server administrators
The most important step is to update the system and the kernel. After updating the kernel, it is usually also necessary to restart the server so that the patched kernel version is actually running.
AlmaLinux / Rocky Linux / RHEL-compatible systems
dnf update kernel\*
rebootDebian / Ubuntu
apt update
apt upgrade
rebootOn servers where an immediate restart is not possible, it is advisable to at least review the available mitigations for the specific distribution. However, the restart should not be postponed unnecessarily, because installing an updated kernel package alone is not enough if the server is still running the old kernel.
How to check if your system is secure
Execute the following commands:
RHEL-based systems
rpm -q --changelog kernel-core | grep -i '31431\|algif_aead\|Copy Fail'Debian / Ubuntu
modprobe -n -v algif_aeadExpected output:
install /bin/falseWhy regular server management matters
Copy Fail is a good example of why it is not enough to install a server once and then leave it unattended. Linux security depends on regular updates, vulnerability monitoring, and timely intervention.
With VPS servers, responsibility for the operating system often lies with the customer, especially in the case of unmanaged servers without administration. If you run an e-commerce store, a company website, mail services, or customer data on your server, we strongly recommend not underestimating updates.
MyDreams.cz recommends
Check your Linux VPS, update the kernel, and schedule a server restart. If you are not sure how to proceed, or if you do not want to handle server administration manually, it is advisable to use managed services or our professional administration.
A secure server is not a one-time installation, but ongoing care. Copy Fail once again reminds us that regular updates are one of the fundamental pillars of secure hosting.