AI Tools Found a Serious Root Exploit in Linux

A Linux kernel privilege escalation vulnerability called 'copy fail' (CVE affecting systems since 2017) was discovered using an AI tool called Xent Code by cybersecurity firm Theori. The exploit chains together the Linux page cache, AF_ALG crypto sockets, splice zero-copy I/O, and the rfc4106 AEAD crypto template to allow an unprivileged user to write arbitrary bytes into page cache pages of readable files. With just 732 bytes of Python, an attacker can corrupt the in-memory version of /usr/bin/su to gain a root shell — without touching the binary on disk, bypassing checksum tools. The primary risk is in multi-user environments and shared container clusters. Mitigation involves patching the kernel or disabling the algif_aead module. The discovery highlights AI as a force multiplier for security researchers with deep domain knowledge.