'Copy Fail' Linux Kernel Root-Escalation Flaw (CVE-2026-31431) Added to CISA KEV as PoC Spreads

CISA added CVE-2026-31431, dubbed 'Copy Fail,' to its Known Exploited Vulnerabilities catalog on May 1, 2026, citing evidence of active exploitation, and set a May 15, 2026 remediation deadline for Federal Civilian Executive Branch agencies under BOD 22-01. The flaw is a local privilege-escalation bug (CVSS 7.8) in the Linux kernel's cryptographic subsystem. According to Microsoft's Defender research team, it stems from an in-place optimization introduced in 2017 in which the kernel reuses source memory as the destination during cryptographic operations; by abusing the interaction between AF_ALG (userspace crypto API) sockets and the splice() system call, an attacker performs a controlled 4-byte write into the kernel's in-memory page cache of any readable file—including setuid binaries—corrupting privileged binaries in memory without modifying them on disk, yielding root.

Tenable reports the bug was found by Taeyang Lee of Theori using the AI-assisted tool Xint Code and privately reported to the Linux kernel security team on March 23, 2026, with public disclosure following on April 29, 2026; it affects any distribution running kernel 4.14 or later (2017 onward). A roughly 732-byte Python proof-of-concept released on GitHub works reliably across major distributions without timing tricks, distinguishing it from Dirty COW and Dirty Pipe. Impact is acute in cloud, container and Kubernetes environments, enabling container breakout, multi-tenant compromise and lateral movement.

Patched kernel versions are 6.18.22, 6.19.12 and 7.0; Microsoft recommends patching or temporarily blocking AF_ALG socket creation and treating any container compromise as potential host compromise. Affected distributions span Ubuntu, Red Hat Enterprise Linux, SUSE, Amazon Linux, Debian, Fedora and Arch.