The Copy.Fail vulnerability is a significant local privilege escalation flaw in the Linux kernel disclosed in April 2026, allowing attackers with limited access to escalate privileges to root by exploiting the kernel crypto API and splice() without modifying files on disk, thus evading detection. Affecting major distributions and shared infrastructure environments like Kubernetes, this vulnerability undermines isolation between users and containers, prompting urgent patch rollouts and discussions about new mitigation strategies such as emergency kernel “killswitches.”
https://www.schneier.com/blog/archives/2026/05/copy-fail-linux-vulnerability.html