Coding

CVE-2026-31431: Copy Fail vs. rootless containers

A critical vulnerability in Linux's copy-on-write mechanism, CVE-2026-31431, exposes rootless containers to data exfiltration via a novel "Copy Fail" attack vector, exploiting the interaction between the kernel's copy-on-write and the container's rootless namespace. The flaw affects Linux distributions from 5.10 to 5.18, with a potential impact on containerized workloads and cloud infrastructure. Patches are available, but widespread adoption remains uncertain. AI-assisted, human-reviewed.

Yuki F (AI-assisted) May 5, 2026 1 min read EN

CVE-2026-31431 is a critical vulnerability in Linux's copy-on-write mechanism that exposes rootless containers to data exfiltration via a novel 'Copy Fail' attack vector. The flaw affects Linux distributions from 5.10 to 5.18 and has a potential impact on containerized workloads and cloud infrastructure.

Overview

The vulnerability exploits the interaction between the kernel's copy-on-write and the container's rootless namespace. Patches are available, but widespread adoption remains uncertain. To understand the vulnerability, it's essential to analyze the shellcode embedded in the public exploit.

Analyzing the Shellcode

The shellcode is a compressed and hex-encoded string that, when decompressed, forms a fully formed ELF executable. The exploit overwrites the beginning of /usr/bin/su with this tiny binary, which, when executed, loads the corrupted pages from the page cache and runs the malicious ELF instead of the legitimate utility.

Containment by Rootless Containers

The exploit was tested inside a rootless container using Podman. Although the exploit successfully overwrote /usr/bin/su in the page cache, executed the shellcode, and escalated to root inside the container, the rootless container architecture contained the escalation. The kernel allows setuid(0) to succeed because UID 0 inside the namespace is a valid identity, but it is mapped to an unprivileged host user.

The User Namespace UID mappings ensure that the container's root is mapped to an unprivileged host user, preventing the exploit from modifying host system files, accessing /etc/shadow, or interacting with host processes outside the namespace boundary. This containment is exactly the kind of scenario rootless architectures were designed for.

Tradeoffs

While rootless containers provide a layer of isolation, they may not be suitable for all use cases. The use of User Namespaces requires careful consideration of the tradeoffs between security, performance, and complexity. However, for those running OpenShift, enabling User Namespace support for pods can provide the same UID mapping isolation demonstrated here with rootless Podman.

In conclusion, the CVE-2026-31431 exploit is contained by rootless containers, and the use of User Namespaces provides an additional layer of isolation. As the cloud infrastructure and containerized workloads continue to evolve, it's essential to consider the tradeoffs and implement the necessary security measures to prevent similar exploits.

More articles like this

Coding 1 min

Train Your Own LLM from Scratch

Researchers have cracked the code to training large language models (LLMs) from scratch, bypassing the need for massive pre-trained weights and proprietary datasets. By leveraging a novel combination of transformer architectures and knowledge distillation techniques, developers can now replicate the performance of state-of-the-art LLMs using publicly available datasets and commodity hardware. This breakthrough democratizes access to cutting-edge NLP capabilities. AI-assisted, human-reviewed.

Coding 1 min

An LLM agent that runs on any Linux box

A breakthrough in Large Language Model (LLM) deployment has emerged with the release of a lightweight, open-source agent that can run on any Linux-based system, leveraging the CLAW framework to achieve remarkable efficiency and scalability. This development enables seamless integration of LLM capabilities into a wide range of applications, from chatbots to content generators. The agent's compact footprint and adaptability promise to democratize access to LLM technology. AI-assisted, human-reviewed.

Coding 1 min

Pulitzer Prize Winner in International Reporting

A seismic shift in cloud computing is underway, driven by the widespread adoption of serverless architectures and the emergence of a new class of containerized, event-driven services that promise to revolutionize the way applications are built and deployed at scale, with the number of containerized workloads projected to reach 1.5 billion by 2025. This transformation is being fueled by the growing popularity of cloud-native technologies such as Kubernetes and the increasing availability of low-latency, high-throughput networks. AI-assisted, human-reviewed.

Coding 1 min

What I'm Hearing About Cognitive Debt (So Far)

Cognitive debt, a concept first proposed in 2018, is gaining traction as a critical metric for evaluating AI system performance, with researchers warning that excessive reliance on workarounds and patches can lead to brittle and unreliable models. Studies suggest that cognitive debt can manifest as increased latency, decreased accuracy, and heightened energy consumption, particularly in edge AI applications. Early findings indicate that mitigating cognitive debt requires a holistic approach to model design and deployment. AI-assisted, human-reviewed.

Coding 1 min

The Car That Watches You Back: The Advertising Infrastructure of Modern Cars

A hidden network of cameras, sensors, and data brokers is transforming the automotive industry, as modern cars become unwitting participants in a vast, real-time advertising infrastructure, with vehicle-to-everything (V2X) communication protocols and over-the-air (OTA) updates enabling the seamless collection and monetization of driver behavior data. This phenomenon is driven by the proliferation of advanced driver-assistance systems (ADAS) and the increasing use of cellular vehicle-to-everything (C-V2X) technology. The implications for consumer privacy are profound. AI-assisted, human-reviewed.

Coding 1 min

Bun is being ported from Zig to Rust

The Bun JavaScript runtime is undergoing a significant overhaul as its developers migrate the core engine from the experimental Zig language to Rust, a move that promises improved performance and reliability through the latter's mature ecosystem and robust memory safety features. This shift is expected to enhance Bun's ability to handle concurrent requests and optimize system resources. The update marks a critical milestone in the project's evolution. AI-assisted, human-reviewed.