Linux Copy Fail flaw exploited to gain root across major distros, CISA warns

TL;DR Summary
CISA warns that the Copy Fail vulnerability (CVE-2026-31431) in the Linux kernel’s algif_aead interface is being exploited to obtain root privileges on unpatched systems, with a PoC shown for Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16. Patches are rolling out across major distros; CISA added the flaw to the Known Exploited Vulnerabilities catalog and urges prompt patching per vendor guidance under BOD 22-01, following earlier patches like Pack2TheRoot.
- CISA says ‘Copy Fail’ flaw now exploited to root Linux systems BleepingComputer
- CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV The Hacker News
- CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments Microsoft
- Update Linux Now As 9-Year-Old Root Hack Confirmed, CISA Warns Users Forbes
- Copy Fail Linux Kernel Vulnerability Now Patched in Debian, Ubuntu, and Others 9to5Linux
Reading Insights
Total Reads
0
Unique Readers
4
Time Saved
3 min
vs 4 min read
Condensed
89%
637 → 72 words
Want the full story? Read the original article
Read on BleepingComputer