Theori's copy-fail-CVE-2026-31431 repository documents a local privilege escalation flaw in the Linux kernel that survived roughly nine years across major distributions, published for authorized research and defensive understanding.

theori-io/copy-fail-CVE-2026-31431 is a research repository from Theori that publishes the artifacts behind a local privilege escalation vulnerability in the Linux kernel, tracked as CVE-2026-31431 and nicknamed Copy Fail. What makes the release notable beyond the bug itself is the discovery attribution: the README's topics and title indicate the flaw was found by Theori's Xint Code system, an AI-driven security research pipeline. The vulnerability is described as having existed for roughly nine years before detection, meaning it was likely introduced by a code change whose implications were subtle enough to survive years of both human and automated review across the kernel's lifetime.

The README is deliberately sparse, which is common for disclosure repositories that accompany a separate technical writeup. The single linked resource is Theori's blog post at hxxps://xint.io/blog/copy-fail-linux-distributions, which is where the detailed vulnerability analysis lives. Readers treating this repo as a documentary artifact should understand that the repository itself functions as the reproducible companion to that writeup rather than as a standalone tutorial. The repo is written primarily in Python, per its language metadata, which suggests the demonstration tooling wraps kernel-interaction primitives in a scriptable harness rather than shipping a bare compiled binary.

The most information-dense element of the README is its tested-distributions table, and it deserves close reading. The listed targets are Ubuntu 24.04 LTS on kernel 6.17.0-1007-aws, Amazon Linux 2023 on 6.18.8-9.213.amzn2023, RHEL 10.1 on 6.12.0-124.45.1.el10_1, and SUSE 16 on 6.12.0-160000.9-default. That spread is significant for defenders: it demonstrates reach across four major enterprise distributions and three distinct kernel version lines (6.12, 6.17, and 6.18), which is characteristic of a bug rooted in long-lived core kernel code rather than in a vendor-specific patch set or a recently merged subsystem.

The kernel version range also corroborates the nine-year framing. A flaw that old would have been inherited by every distribution branch that carried the affected code forward, and the fact that current-generation releases of RHEL, SUSE, Ubuntu, and Amazon Linux all test as affected means patch coverage could not be assumed from freshness alone. For asset owners, the practical defensive takeaway from this table alone is that kernel-version inventory matters more than distro brand: an organization running the newest RHEL 10.1 image was in the same exposure class as one on an older Ubuntu LTS cloud kernel. This is exactly the kind of blind spot that kernel LPE disclosures routinely expose in otherwise well-managed estates.

The repository's topic tags reinforce its research positioning: security-research, vulnerability, exploit, linux-kernel, privilege-escalation, and the specific cve-2026-31431 marker, alongside theori, xint-code, and ai-security. The ai-security tag is the interesting meta-signal. Finding a nine-year-old privilege escalation in heavily audited kernel code is precisely the kind of task where automated research tooling changes the economics of vulnerability discovery, and the public pairing of Xint Code with a real, distributed CVE is a demonstration of that capability rather than a marketing claim. For the research community, it also raises the odds that other long-dormant bugs of the same class will surface through similar pipelines.

The name Copy Fail points at the failure mode: something in a memory-copy path went wrong, and the result was a condition exploitable for local privilege escalation. Kernel copy primitives between user and kernel space are historically fertile ground for LPE bugs because their correctness depends on nuanced interaction with mm subsystem internals. We deliberately avoid operational specifics here — this writeup is documentary analysis of a published research artifact, not a reproduction guide — but the class of bug explains the breadth of affected distributions: such primitives sit at the center of every kernel build and are not optional or config-gated in the way many subsystem-specific bugs are.

From a defensive operations perspective, the released research is most useful for prioritization and detection engineering. The tested-distro table effectively serves as a coarse affected-versions matrix, giving patch-management teams a concrete starting checklist of kernel packages to verify against their vendors' advisories. Detections for kernel LPE attempts typically live in monitoring for anomalous privilege transitions, kernel warnings or oopses in dmesg from failed copy or fault-handling paths, and audit records showing an unprivileged UID spawning privileged processes. Because the bug's mechanics involve a failed copy operation, crash or warning output on affected systems may be noisy enough to be observable even on unsuccessful attempts, which is worth validating in a lab.

For authorized offensive professionals — internal red teams, pentesters with written scope on client-owned systems — the repository's value is in validating that a patched kernel actually resolves the issue and in demonstrating to clients why kernel patch latency matters. The Python implementation makes it straightforward to integrate into an existing engagement harness for verification runs against systems the team is contractually authorized to test. It should go without saying, but bears repeating in any treatment of public LPE code: running it against systems you do not own or administer is unauthorized access, full stop. The existence of a public repository does not change the legal boundary.

With over four thousand stars at the time of this analysis, the repository has clearly resonated with the security community, which cuts both ways. High visibility means defenders can assume attackers are equally aware, and patch urgency for CVE-2026-31431 should be treated accordingly by any organization running the affected kernel families. It also means the writeup at the linked xint.io blog is now part of the permanent public record on this bug class, and engineering teams that ignore it are choosing not to read a public document their adversaries have read.

The repository has no declared license at the time of writing, which is worth noting for anyone considering reuse of the code beyond personal study — absence of a license means default copyright restrictions apply and derivative or commercial use is not clearly permitted. It also carries no LICENSE file guidance on responsible use, though the disclosure context (a coordinated CVE with a technical writeup) situates it firmly in the research-publication tradition rather than in offensive tooling distribution.

In sum, copy-fail-CVE-2026-31431 is a compact but consequential disclosure artifact: a four-line README, a tested-distro matrix spanning the major enterprise Linux families, and a pointer to a writeup on a bug that lived for nine years and was surfaced by AI-assisted research. For defenders, the action items are kernel inventory, advisory tracking, and detection validation. For researchers, it is a data point in the ongoing shift toward automated vulnerability discovery at the kernel's deepest layers.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.