AI tools uncover critical Linux kernel vulnerabilities
AI security tools discovered multiple critical Linux kernel vulnerabilities that allow unprivileged users to gain root access on affected systems. Zellic's V12 tool and Theori's Xint Code identified Fragnesia and Copy Fail vulnerabilities respectively, which exploit page-cache corruption in kernel subsystems.
What happened
AI security tools discovered multiple critical Linux kernel vulnerabilities within two weeks. Zellic's V12 tool, used by William Bowling and other researchers, found the Fragnesia vulnerability by abusing a logic bug in the Linux XFRM ESP-in-TCP subsystem to write arbitrary bytes into kernel page cache without requiring race conditions.
Theori's Xint Code AI tool identified the Copy Fail vulnerability (CVE-2026-31431) after researcher Taeyang Lee created a prompt to scan the Linux crypto subsystem, discovering multiple vulnerabilities within about one hour. Copy Fail affects almost all Linux distributions released since 2017 and allows unprivileged users to gain root control.
Reported impact
Fragnesia yields immediate root access on all major Linux distributions, opening doors to local privilege escalation and potential container escapes in multi-tenant environments. Unlike classic race-condition exploits, attacks are more reliable and easier to weaponize because they precisely corrupt file-backed pages without timing tricks.
Copy Fail exploits page-cache corruption that is not marked as dirty pages and is not flushed to disk by kernel write-back mechanisms, making it undetectable by monitoring tools such as AIDE, Tripwire and OSSEC that compare disk checksums. A proof-of-concept exploit for Fragnesia already exists that maps keystream bytes to nonces and overwrites the first 192 bytes of the switch user command.
Index analysis
AI-agentic tools proved significantly faster than human researchers at identifying security flaws in complex kernel code. Both vulnerabilities exploited page-cache corruption mechanisms in subsystems that handle cryptographic operations and file transformations.
Governance controls
A patch for Copy Fail was added to the mainline Linux kernel on 1 April. Linux distributions including Arch Linux and Red Hat Fedora have released patches or mitigations for the vulnerability.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.