News

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a recently disclosed Linux kernel vulnerability to its Known Exploited Vulnerabilities (KEV) catalog after observing evidence of in-the-wild exploitation. The flaw is tracked as CVE-2026-31431 and carries a CVSS score of 7.8.

Classified as a local privilege-escalation bug, CVE-2026-31431 can allow an unprivileged account on a vulnerable system to attain root privileges. Security researchers and trackers Theori and Xint have dubbed the issue “Copy Fail.” Corrections have been released in Linux kernel updates 6.18.22, 6.19.12 and 7.0.

In its advisory, CISA described the problem as an improper resource transfer between kernel components that can lead to privilege elevation. The research team that originally analyzed the defect explains that Copy Fail stems from a logic error in the kernel’s authentication cryptographic template. That weakness can be exploited reliably with a compact, 732-byte Python proof-of-concept to escalate privileges. The vulnerability originated from three separate, innocuous kernel changes made in 2011, 2015 and 2017.

The defect affects Linux builds distributed since 2017 and enables an attacker with local access to corrupt the kernel’s in-memory page cache for any readable file, including setuid binaries. By tampering with the page cache, an adversary can alter the behavior of executables at runtime-without modifying files on disk-and thereby achieve code execution as root.

Google-owned Wiz explained that because the page cache reflects executables in memory, modifying it effectively changes binaries when they run; attackers can thus inject payloads into privileged programs (for example, /usr/bin/su) to gain full root rights.

Given Linux’s dominance in cloud infrastructure, the vulnerability poses heightened risk in multi-tenant and containerized environments. Kaspersky’s analysis highlights that container runtimes such as Docker, LXC and Kubernetes commonly provide processes inside containers access to the AF_ALG cryptographic interface when the algif_aead module is present in the host kernel.

Kaspersky warned this means Copy Fail could be abused to break container isolation and take control of the underlying host. The vendor emphasized that exploitation does not rely on complex techniques like race conditions or guessing memory addresses, which lowers the technical barrier for attackers. Detection is also challenging because the exploit relies solely on legitimate system calls that are difficult to distinguish from normal application activity.

A fully functional proof-of-concept exploit is already public, and Kaspersky reports that community repositories contain ports of the original Python PoC into Go and Rust. CISA declined to provide specifics about active attacks, but Microsoft’s Defender Security Research Team said it is seeing early test activity that could presage increased exploitation in the coming days.

Microsoft noted the attack vector is local (AV:L), requires only low privileges and no user interaction, so any unprivileged account on a vulnerable host can attempt exploitation. While the bug cannot be exploited remotely by itself, it becomes highly dangerous when chained with initial access methods such as SSH credentials, malicious CI jobs, or a foothold inside a container. Microsoft outlined one likely attack sequence:

1) Reconnaissance to locate a Linux host or container running a vulnerable kernel version.
2) Crafting a small Python trigger to target the endpoint.
3) Running the exploit from a low-privilege context-either a normal user on the host or a compromised container process without extra capabilities.
4) The exploit performs a controlled 4-byte overwrite in the kernel page cache, corrupting sensitive kernel-managed data.
5) The attacker elevates their process to UID 0 and obtains full root privileges.

Federal Civilian Executive Branch (FCEB) agencies have been instructed to apply available updates by May 15, 2026; major Linux distributions have already pushed patches. For organizations that cannot immediately patch, recommended mitigations include disabling the affected feature, enforcing network segmentation, and tightening access controls to reduce exposure.