# Major Linux Security Vuln "CopyFail" **URL:** \ **Category:** Ignition\ **Created:** [April 30, 2026, 10:34pm UTC](https://forum.inductiveautomation.com/t/major-linux-security-vuln-copyfail/115340 "2026-04-30T22:34:09Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [April 30, 2026, 10:34pm UTC](https://forum.inductiveautomation.com/t/major-linux-security-vuln-copyfail/115340/1 "2026-04-30T22:34:09Z")
Announced last night... > **[The most severe Linux threat to surface in years catches the world flat-footed](https://arstechnica.com/security/2026/04/as-the-most-severe-linux-threat-in-years-surfaces-the-world-scrambles/)** > > CopyFail threatens multi-tenant servers, CI/CD work flows, Kubernetes containers, and more. TL/DR: - Almost all versions of Linux affected, including WSL/WSL2. - Security researcher announced suddenly, with major distros not yet patched. - Privilege escalation allows any user running code on a target can escalate to root - Include escalation from container scope to host scope - Does not appear to affect other Virtual Machines. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [April 30, 2026, 11:54pm UTC](https://forum.inductiveautomation.com/t/major-linux-security-vuln-copyfail/115340/2 "2026-04-30T23:54:20Z")
Quick mitigation on unpatched systems: > should **disable the `algif_aead` module** via standard kernal module blacklisting. ...presuming you are not using that specific crypto algorithm, of course. ---
**Author:** ![JordanCClark](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jordancclark/32/83362_2.png) [@JordanCClark](https://forum.inductiveautomation.com/u/JordanCClark)\ **Post date:** [May 1, 2026, 12:06pm UTC](https://forum.inductiveautomation.com/t/major-linux-security-vuln-copyfail/115340/3 "2026-05-01T12:06:15Z")
For those wondering on the mitigation steps. ```bash echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf rmmod algif_aead 2>/dev/null || true ``` ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [May 1, 2026, 12:20pm UTC](https://forum.inductiveautomation.com/t/major-linux-security-vuln-copyfail/115340/4 "2026-05-01T12:20:38Z")
> **[Copy Fail — 732 Bytes to Root](https://copy.fail/)** > > CVE-2026-31431. 100% Reliable Linux LPE — no race, no per-distro offsets, page-cache write that bypasses on-disk file-integrity tools and crosses containers. Found by Xint Code. Luckily it does require local access to the machine, not that its good, obviously this is a serious explot that you should mititgate, but that does make it a little bit easier to sleep at night. ---
**Author:** ![JordanCClark](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jordancclark/32/83362_2.png) [@JordanCClark](https://forum.inductiveautomation.com/u/JordanCClark)\ **Post date:** [May 1, 2026, 12:37pm UTC](https://forum.inductiveautomation.com/t/major-linux-security-vuln-copyfail/115340/5 "2026-05-01T12:37:07Z")
Not directly, but, if they manage to get a script uploded and run as a local user, that could be a problem. Not saying we should panic, per se. Just that the potential is there. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [May 1, 2026, 12:40pm UTC](https://forum.inductiveautomation.com/t/major-linux-security-vuln-copyfail/115340/6 "2026-05-01T12:40:49Z")
> [@bkarabinchak.psi](#): > > require local access Which is why this has a CVSS score of 7.8 instead of 9+. I run a lot of linux machines with this vuln but, as I have no users other than me, am basically safe. The businesses running Ignition in containers for third parties are the ones who should be concerned here. (Because a designer pointed at such a gateway could compromise the entire set of containers.) ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [May 1, 2026, 12:48pm UTC](https://forum.inductiveautomation.com/t/major-linux-security-vuln-copyfail/115340/7 "2026-05-01T12:48:34Z")
Found the script if anyone cares to see [GitHub - rootsecdev/cve\_2026\_31431: Exploit POC for CVE\_2026\_31431 · GitHub](https://github.com/rootsecdev/cve_2026_31431) Hypothetically it seems like someone could use designer, access a remote linux gateway, create this python script on the gateway with a gateway message handler+system.file.writeFile, execute it, and now whatever user Ignition is running as has root privileges? Per Copy.Fail ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/f/5/f57236f301c15e24ee15292f6a59889ae17cb3fe.png) Seems like Ignition could be medium-high depending on your setup. You would still need a designer login but after that seems trivial for a knowledgable party?