A particularly serious development in the cybersecurity space has put system administrators, DevOps teams, and businesses that rely on Linux infrastructure on alert. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added the CVE-2026-31431 vulnerability to its list of Known Exploitable Vulnerabilities (KEV), confirming that it is already being exploited in real attacks .
The vulnerability, known in the research community as Copy Fail, is rated CVSS 7.8 and is Escalation flaw . Simply put, it allows a user with limited privileges to gain root, meaning complete control of a Linux system.
See also: Copy Fail: Linux vulnerability allows root access to systems
A bug that was hidden for almost a decade
This particular vulnerability is striking not only for its severity but also for its longevity. The bug remained embedded in the Linux kernel for about nine years, undetected. The vulnerability affects Linux distributions released since 2017.
Researchers at Theori and Xint revealed that the vulnerability resulted from three separate kernel modifications, implemented in 2011, 2015, and 2017. Each of these was considered innocent when introduced, but their combination created a dangerous logic bug in the Linux kernel's authentication cryptographic template.
The nature of the problem makes the exploitation particularly efficient: an exploit of just 732 bytes, written in Python, is enough to trigger the attack chain.
Linux kernel: How Copy Fail works
At the core of the attack is the ability to corrupt the in-memory page cache of any readable file, including setuid binaries.
The attacker can modify data in memory without touching the files on disk. This means they can inject malicious code into critical binaries like /usr/bin/su, which have elevated privileges.
The practical consequence is that the system executes altered code with root privileges, without leaving the classic traces of file modification that could be detected by traditional security tools.
Cloud and containers in focus
The importance of the vulnerability is made even greater by the widespread use of Linux in cloud environments.
According to security analysts, Copy Fail directly affects containerization platforms such as Docker , LXC , and Kubernetes , especially when the AF_ALG subsystem is enabled via the algif_aead module .
See also: CISA adds Wing FTP vulnerability to KEV list
In such scenarios, an attacker who gains access inside a container can use the vulnerability to "break" the isolation of the environment and pass to the host system.
This turns a single compromised container into a potential point of complete compromise of the entire infrastructure.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
For organizations based on microservices and multi-tiered cloud architectures, the risk is extremely high.
Detection is particularly difficult
One of the most concerning features of the Copy Fail vulnerability is its low visibility. The exploit relies solely on legitimate system calls, making it difficult to distinguish malicious activity from normal system operation.
At the same time, the existence of public PoC exploits in Python, Go, and Rust significantly lowers the technical barrier for would-be attackers.
Microsoft has already recorded early testing activity, warning that the public release of the exploit could lead to a wave of mass attacks in the coming days.
The possible attack scenario
The exploitation process is relatively simple:
The attacker locates a vulnerable Linux host, gains limited access via SSH, CI pipeline or compromised container, executes the exploit and causes controlled corruption of four bytes in kernel memory.
This is enough to upgrade the permissions of his process to UID 0, gaining full control.
See also: CISA adds 8 vulnerabilities to the KEV List
What should organizations do?
The fixes have already been incorporated into Linux kernel versions 6.18.22, 6.19.12, and 7.0. CISA has asked U.S. federal agencies to complete the installation of the patches by May 15, 2026.
For businesses, the recommendation is clear: immediate notification, restriction of access to AF_ALG, strengthening access controls, and strict isolation of workloads.
The Copy Fail incident is yet another reminder that even mature, trusted ecosystems like Linux can hide critical vulnerabilities for years. In the world of modern cybersecurity, speed of response remains the most powerful weapon against emerging threats.
