CVE 2026-31431 - CopyFail - root from running a python script

[niclaz]

A few hours ago I read about CopyFail (sources below) and decided to test and outdated Linux Mint box I use for side projects.

priviledge escalation to root confirmed in the following setups:

• Linux Mint 22.2 & Kernel: 6.17.0-22-generic
• Linux Mint 22.3 & Kernel: 6.17.0-22-generic
• Linux Mint 22.3 & Kernel: 6.8.0-110-generic

After testing the exploit I upgraded to version 22.3, tested again, then changed to 6.8.0 Kernel and tested again.

Flagging this in this Dicussion post to get developer attention and alert the community.

Sources

Announcement website: https://copy.fail/
Techincal writeup: https://xint.io/blog/copy-fail-linux-distributions
Code repo: https://github.com/theori-io/copy-fail-CVE-2026-31431
Issue open relating to Mint: theori-io/copy-fail-CVE-2026-31431#11

[rcalixte]

The kernels for Linux Mint are provided from the upstreams (Debian & Ubuntu). Unfortunately, the originators of this CVE did not follow proper responsible disclosure so Debian (and the related downstreams) were not notified appropriately and the patches have not yet been made available.

EDIT: Debian has patches available for Trixie. You should be able to manually apply the mitigation until patches are available.

[niclaz]

ran apt upgrade and can confirm exploit is patched and has also been reported by others in issue 11 referenced above

System: Linux Mint 22.3
Kernel: 6.17.0-23-generic

thanks @rcalixte