{"id":"linux-copy-fail-takeover-apr-2026","category":"patch","status":"live","title":"Linux Copy Fail flaw CVE-2026-31431 used in attacks to gain full control","tldr":"Copy Fail lets someone already running code on an affected Linux machine gain administrator control. Attackers are using it. Install your distribution's kernel security updates and restart; some specialist kernels still lack a fix.","summary":"Copy Fail, CVE-2026-31431, is a flaw in the Linux kernel's cryptographic interface that lets a local attacker gain full administrator control. It affects Linux computers and servers using vulnerable kernels; the attacker needs an existing account or another way to run code on the machine. Canonical also warns that it could help an attacker escape a container. Researchers reported it privately in March, a mainline fix was committed in April, and CISA confirmed exploitation on 1 May. The reviewed sources do not identify victims or establish the scale of attacks, and CISA lists ransomware use as unknown. Upstream kernel fixes and distribution updates are available, with Red Hat reporting all its fixes released. Coverage remains partial: Ubuntu's October tracker still lists its specialist Azure NVIDIA kernel as vulnerable. Users should install their distribution's fixed kernel and restart.","action":"If you use Linux, install all kernel security updates through your distribution's normal updater, then restart the computer. Ask whoever manages your business servers or cloud systems to confirm that the running kernel fixes CVE-2026-31431; where a fix remains unavailable, they should apply the distribution's temporary mitigation.","product":"Linux kernel on Linux computers, servers and container hosts","audience":"both","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2026-31431"],"tags":["linux","kernel","copy-fail","privilege-escalation","actively-exploited"],"affected":["Upstream Linux kernels from 4.14 that lack the relevant fix or backport; kernels before 4.14 are listed as unaffected.","Upstream affected branches before 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.22 and 6.19.12; mainline versions before 7.0.","Ubuntu 24.04 LTS linux-azure-nvidia: tracker still lists vulnerability with work in progress in 6.8.0-1039.42.","Ubuntu distribution kernels require their package-specific fixes; upstream version thresholds do not account for distribution backports."],"fixed":["Upstream Linux 5.10.254","Upstream Linux 5.15.204","Upstream Linux 6.1.170","Upstream Linux 6.6.137","Upstream Linux 6.12.85","Upstream Linux 6.18.22","Upstream Linux 6.19.12","Upstream Linux 7.0","Ubuntu 22.04 LTS standard kernel: 5.15.0-179.189","Ubuntu 22.04 LTS HWE kernel: 6.8.0-117.117~22.04.1","Ubuntu 24.04 LTS standard kernel: 6.8.0-117.117","Ubuntu 24.04 LTS HWE kernel: 6.17.0-29.29~24.04.1"],"matches":[{"platform":"linux","app":"Ubuntu 22.04 LTS standard kernel","bundle":"","fixed":"5.15.0-179.189"},{"platform":"linux","app":"Ubuntu 22.04 LTS HWE kernel","bundle":"","fixed":"6.8.0-117.117~22.04.1"},{"platform":"linux","app":"Ubuntu 24.04 LTS standard kernel","bundle":"","fixed":"6.8.0-117.117"},{"platform":"linux","app":"Ubuntu 24.04 LTS HWE kernel","bundle":"","fixed":"6.17.0-29.29~24.04.1"}],"sources":[{"kind":"advisory","title":"Linux CNA record for CVE-2026-31431","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/31xxx/CVE-2026-31431.json","by":"Linux","date":"2026-08-05"},{"kind":"advisory","title":"CVE-2026-31431: Ubuntu package status","url":"https://ubuntu.com/security/CVE-2026-31431","by":"Canonical","date":"2026-10-12"},{"kind":"advisory","title":"Fixes available for CVE-2026-31431 (Copy Fail)","url":"https://ubuntu.com/blog/copy-fail-vulnerability-fixes-available","by":"Canonical","date":"2026-04-30"},{"kind":"advisory","title":"RHSB-2026-002: Cryptographic Subsystem Privilege Escalation — Copy Fail","url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-002","by":"Red Hat","date":"2026-05-13"},{"kind":"research","title":"Copy Fail: 732 Bytes to Root on Every Major Linux Distribution","url":"https://xint.io/blog/copy-fail-linux-distributions","by":"Xint","date":"2026-04-29"},{"kind":"advisory","title":"High Vulnerability in the Linux Kernel (Copy Fail)","url":"https://cert.europa.eu/publications/security-advisories/2026-005/markdown","by":"CERT-EU","date":"2026-04-30"},{"kind":"advisory","title":"Known Exploited Vulnerabilities catalogue: CVE-2026-31431","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-05-01"}],"started":"2026-05-01","closed":null,"created":"2026-11-03T22:28:09.720Z","updated":"2026-11-03T22:28:09.720Z","cve_notes":[{"cve":"CVE-2026-31431","name":"Copy Fail privilege escalation in Linux cryptography","what":"Incorrect handling of shared memory in the Linux kernel's algif_aead cryptographic interface lets an attacker already running code locally alter cached file contents and gain administrator control.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-10-12","added":"2026-11-03T22:22:59.664Z","kind":"vendor-revised","text":"Ubuntu's updated tracker lists fixes for standard supported kernels, but still marks Ubuntu 24.04's linux-azure-nvidia package as vulnerable, with work in progress in 6.8.0-1039.42. Ubuntu 26.04 and 26.10 are listed as unaffected.","url":"https://ubuntu.com/security/CVE-2026-31431","by":"Canonical","patch":"partial"},{"at":"2026-05-13","added":"2026-11-03T22:22:59.664Z","kind":"vendor-revised","text":"Red Hat's updated bulletin marked the issue resolved and said all its fixes were available.","url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-002","by":"Red Hat","patch":null},{"at":"2026-05-04","added":"2026-11-03T22:22:59.664Z","kind":"new-fix","text":"Red Hat released its first product fix, for Red Hat Enterprise Linux 9.","url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-002","by":"Red Hat","patch":"partial"},{"at":"2026-05-01","added":"2026-11-03T22:22:59.664Z","kind":"cisa-added","text":"CISA added the flaw to its Known Exploited Vulnerabilities catalogue, confirming use in attacks. It set a 15 May remediation deadline for US federal civilian agencies; ransomware use was listed as unknown.","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-04-29","added":"2026-11-03T22:22:59.664Z","kind":"other","text":"Xint published its Copy Fail research, reporting successful administrator takeovers on tested Ubuntu, Amazon Linux, Red Hat Enterprise Linux and SUSE systems.","url":"https://xint.io/blog/copy-fail-linux-distributions","by":"Xint","patch":null},{"at":"2026-04-22","added":"2026-11-03T22:22:59.664Z","kind":"disclosed","text":"Linux published CVE-2026-31431 for a flaw in its algif_aead cryptographic interface.","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/31xxx/CVE-2026-31431.json","by":"Linux","patch":null},{"at":"2026-04-01","added":"2026-11-03T22:22:59.664Z","kind":"new-fix","text":"The fix was committed to the mainline Linux kernel. This did not mean Linux distributions had released updated kernel packages.","url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-002","by":"Red Hat","patch":"partial"},{"at":"2026-03-23","added":"2026-11-03T22:22:59.664Z","kind":"other","text":"The researchers privately reported the vulnerability to the Linux kernel security team.","url":"https://xint.io/blog/copy-fail-linux-distributions","by":"Xint","patch":"none"}],"url":"https://hard.fyi/live/linux-copy-fail-takeover-apr-2026/","json":"https://hard.fyi/api/live?id=linux-copy-fail-takeover-apr-2026"}