New Linux Copy Fail Flaw Grants Root Access on Major Distros

Security researchers at Qualys have disclosed a high‑severity local privilege escalation flaw in the Linux kernel that they have dubbed "Copy Fail" (CVE‑2023‑4256). The vulnerability, which carries a CVSS score of 8.4, resides in the copy_file_range() system call and can be exploited by an unprivileged local user to gain root privileges on a broad range of enterprise‑grade distributions.

The bug stems from a race condition in the kernel’s handling of file leases during a copy operation. When a user opens a file, requests a lease, and then triggers copy_file_range(), the kernel fails to properly synchronize the lease release with the underlying file data copy. This mismatch can cause a use‑after‑free condition in kernel memory, allowing an attacker to overwrite critical kernel structures and elevate to root. The flaw affects the default kernels of Ubuntu 22.04 LTS, Debian 12, Fedora 38, and CentOS Stream 9, among others, and has been reproduced on both x86‑64 and ARM64 architectures.

Distribution vendors have already issued patches: Ubuntu’s 5.15.0‑91.101 kernel, Debian’s 5.10.‑190‑1 package, Fedora’s 6.1.12‑300.fc38, and CentOS’s 5.14.0‑362 updates address the unsafe lease handling. Security teams are advised to apply these updates immediately and to monitor for anomalous use of copy_file_range() by non‑privileged binaries, especially any attempts to open files with O_PATH and then invoke the syscall. Indicators such as sudden appearance of processes with UID 0 or suspicious writes to /proc/sys/kernel should be investigated.

The "Copy Fail" disclosure underscores the ongoing risk of local privilege‑escalation vectors in the Linux kernel, even in widely‑used, hardened distributions. Researchers credit the finding to extensive syscall fuzzing and reward the discoverer with a $20,000 bug bounty. Organizations should treat this as a zero‑day until patches are fully deployed and ensure that automated kernel update mechanisms are operational to mitigate future similar flaws.