The Hour That Changed the Vulnerability Calculus

For most of the past decade, if you wanted to find a deep kernel-level flaw in Linux, you needed two things: significant expertise and significant time. The Linux kernel has been reviewed continuously by some of the best security researchers in the world. Dirty Cow, the 2016 privilege escalation vulnerability that affected every Linux kernel since 2007, sat undetected for nine years before a researcher stumbled across evidence of it being exploited in the wild. Dirty Pipe, its spiritual successor, was found in 2022 after a developer spent months chasing a mysterious file corruption bug before realising what he was actually looking at.

Both discoveries were the product of deep human expertise, sustained attention, and a degree of luck.

Last week, Theori’s AI-assisted security tool Xint Code found Copy Fail in about an hour.

Copy Fail, CVE-2026-31431, is a local privilege escalation vulnerability affecting virtually every major Linux distribution released since 2017. A single 732-byte Python script gives any local user a reliable, deterministic path to root on Ubuntu, Red Hat Enterprise Linux, Amazon Linux, and SUSE. No race conditions to win. No per-distribution customisation required. The same script, every system, every time.

That is a serious vulnerability and it needs patching. But the more consequential story is not the vulnerability itself. It is how it was found, and what that means for everyone who builds threat models that assume kernel-grade flaws are rare.

The flaw exists at the intersection of three separate kernel changes made between 2011 and 2017. None of them was problematic in isolation. The vulnerability only emerges when you trace the interaction between AF_ALG sockets, the splice() system call, and a 2017 in-place optimisation to the authencesn cryptographic template. Each change was reasonable. Nobody connected them. The resulting write path has been silently exploitable for nearly nine years.

Human reviewers missed it because they were looking at each component through the lens of its own correctness. The crypto subsystem was heavily reviewed for cryptographic properties: side channels, parameter validation, algorithmic soundness. Copy Fail is not a cryptographic flaw. It is a question about where memory came from and whether the kernel should ever be writing through it. That is a different type of question, and one that requires holding the entire call chain in view simultaneously rather than auditing each component on its own terms.

That is exactly the kind of reasoning that AI-assisted tools are increasingly good at. Xint Code was given a single operator prompt: examine all code paths reachable from userspace syscalls, with the observation that splice() can deliver page-cache references of read-only files to crypto TX scatterlists. One hour later, Copy Fail was the highest severity output of the scan. The same run also surfaced additional high-severity vulnerabilities that are still under coordinated disclosure.

This is the part that should change how security leaders think about their threat model.

The economics of vulnerability research have shifted. Finding a kernel-grade privilege escalation used to require the kind of expertise and time that placed it firmly in the domain of well-resourced nation state actors or the most capable independent researchers. The gray-market price for a universal, reliable Linux local privilege escalation reflected that scarcity. The assumption built into most organisations’ risk models, that this class of vulnerability is rare because it is expensive to find, is being stress-tested in real time.

That assumption is not wrong yet. But the direction of travel is clear, and the speed of that travel is faster than most organisations are adjusting for.

The implication is not that AI-assisted vulnerability discovery is a threat in itself. Theori used it responsibly, coordinated disclosure was handled correctly, and the Linux kernel community had patches ready before public disclosure. The implication is that the same class of tooling that found Copy Fail for a legitimate research team is becoming more accessible, and the skill required to operate it is declining faster than the skill required to defend against what it finds.

The organisations that adjust their threat models now, that move from assuming kernel-grade vulnerabilities are rare to treating them as a normal part of the exposure surface, will be better positioned than those who wait for the next disclosure to force the conversation.

Copy Fail will be patched. The hour it took to find it will not be forgotten.