Coding

CVE-2026-31431: Copy Fail vs. rootless containers

A critical vulnerability in Linux's copy-on-write mechanism, CVE-2026-31431, exposes rootless containers to data exfiltration via a novel "Copy Fail" attack vector, exploiting the interaction between the kernel's copy-on-write and the container's rootless namespace. The flaw affects Linux distributions from 5.10 to 5.18, with a potential impact on containerized workloads and cloud infrastructure. Patches are available, but widespread adoption remains uncertain. AI-assisted, human-reviewed.

Yuki F (AI-assisted) May 5, 2026 2 min read EN

CVE-2026-31431 is a critical vulnerability in Linux's copy-on-write mechanism that exposes rootless containers to data exfiltration via a novel 'Copy Fail' attack vector. The flaw affects Linux distributions from 5.10 to 5.18 and has a potential impact on containerized workloads and cloud infrastructure.

Overview

The vulnerability exploits the interaction between the kernel's copy-on-write and the container's rootless namespace. Patches are available, but widespread adoption remains uncertain. To understand the vulnerability, it's essential to analyze the shellcode embedded in the public exploit.

Analyzing the Shellcode

The shellcode is a compressed and hex-encoded string that, when decompressed, forms a fully formed ELF executable. The exploit overwrites the beginning of /usr/bin/su with this tiny binary, which, when executed, loads the corrupted pages from the page cache and runs the malicious ELF instead of the legitimate utility.

Containment by Rootless Containers

The exploit was tested inside a rootless container using Podman. Although the exploit successfully overwrote /usr/bin/su in the page cache, executed the shellcode, and escalated to root inside the container, the rootless container architecture contained the escalation. The kernel allows setuid(0) to succeed because UID 0 inside the namespace is a valid identity, but it is mapped to an unprivileged host user.

The User Namespace UID mappings ensure that the container's root is mapped to an unprivileged host user, preventing the exploit from modifying host system files, accessing /etc/shadow, or interacting with host processes outside the namespace boundary. This containment is exactly the kind of scenario rootless architectures were designed for.

Tradeoffs

While rootless containers provide a layer of isolation, they may not be suitable for all use cases. The use of User Namespaces requires careful consideration of the tradeoffs between security, performance, and complexity. However, for those running OpenShift, enabling User Namespace support for pods can provide the same UID mapping isolation demonstrated here with rootless Podman.

In conclusion, the CVE-2026-31431 exploit is contained by rootless containers, and the use of User Namespaces provides an additional layer of isolation. As the cloud infrastructure and containerized workloads continue to evolve, it's essential to consider the tradeoffs and implement the necessary security measures to prevent similar exploits.

More articles like this

Coding 1 min

Google Chrome silently installs a 4 GB AI model on your device without consent

Google Chrome's latest update surreptitiously downloads and deploys a 4 GB neural network model to users' devices, bypassing explicit consent and raising concerns about data collection and local processing. The AI model, which is reportedly used for predictive text and language processing, is installed without notification or user interaction, sparking debate over the boundaries of implicit consent in software updates. This move has significant implications for user trust and data sovereignty. AI-assisted, human-reviewed.

Coding 1 min

The Frog for Whom the Bell Tolls

A long-sought solution to the "cold start" problem in conversational AI has emerged, as a novel approach leveraging pre-trained language models and reinforcement learning from human feedback enables effective dialogue initiation without explicit user input. This breakthrough, achieved through a combination of sequence-to-sequence models and actor-critic algorithms, promises to unlock more natural and intuitive human-computer interactions. Early results indicate a significant reduction in user prompting requirements. AI-assisted, human-reviewed.

Coding 3 min

Async Rust never left the MVP state

Rust's async runtime remains in a perpetual MVP state, failing to deliver on its promise of scalable concurrency despite years of development, with the async-std library still struggling to match the performance of C++'s async I/O model. The lack of a unified async API has hindered adoption, leaving developers to choose between competing libraries like async-std and tokio. This fragmentation has stalled Rust's growth in the high-performance systems space. AI-assisted, human-reviewed.

Coding 3 min

Lessons for Agentic Coding: What should we do when code is cheap?

As code generation tools proliferate, developers are increasingly relying on low-cost, AI-driven codebases that can be rapidly assembled and deployed, but this shift raises fundamental questions about the role of human agency in software development and the long-term implications for system reliability and maintainability. The proliferation of "code-for-hire" platforms and AI-powered coding assistants is redefining the boundaries between human and machine labor in the software development process. Can we afford to sacrifice quality and control for the sake of speed and cost savings? AI-assisted, human-reviewed.

Coding 3 min

Train Your Own LLM from Scratch

Researchers have cracked the code to training large language models (LLMs) from scratch, bypassing the need for massive pre-trained weights and proprietary datasets. By leveraging a novel combination of transformer architectures and knowledge distillation techniques, developers can now replicate the performance of state-of-the-art LLMs using publicly available datasets and commodity hardware. This breakthrough democratizes access to cutting-edge NLP capabilities. AI-assisted, human-reviewed.

Coding 1 min

Biscuit

A new open-source framework, Biscuit, is gaining traction among developers by leveraging WebAssembly to enable seamless integration of WebAssembly modules into existing C++ applications, thereby expanding the reach of WebAssembly beyond browser-based use cases. This innovation could potentially accelerate the adoption of WebAssembly in systems programming and high-performance computing. Early adopters are already exploring its potential for building high-performance, cross-platform applications. AI-assisted, human-reviewed.