NewsCompaniesFlawsGuides
Get the app
HighPartly fixedBeing used in attacksUpdated

Linux Copy Fail flaw CVE-2026-31431 used in attacks to gain full control

Copy Fail lets someone already running code on an affected Linux machine gain administrator control. Attackers are using it. Install your distribution's kernel security updates and restart; some specialist kernels still lack a fix.

What to do

If you use Linux, install all kernel security updates through your distribution's normal updater, then restart the computer. Ask whoever manages your business servers or cloud systems to confirm that the running kernel fixes CVE-2026-31431; where a fix remains unavailable, they should apply the distribution's temporary mitigation.

Check your devices
  • Ubuntu 22.04 LTS standard kernelfixed in 5.15.0-179.189 and later
  • Ubuntu 22.04 LTS HWE kernelfixed in 6.8.0-117.117~22.04.1 and later
  • Ubuntu 24.04 LTS standard kernelfixed in 6.8.0-117.117 and later
  • Ubuntu 24.04 LTS HWE kernelfixed in 6.17.0-29.29~24.04.1 and later

What’s happening

Copy Fail, CVE-2026-31431, is a flaw in the Linux kernel's cryptographic interface that lets a local attacker gain full administrator control. It affects Linux computers and servers using vulnerable kernels; the attacker needs an existing account or another way to run code on the machine. Canonical also warns that it could help an attacker escape a container. Researchers reported it privately in March, a mainline fix was committed in April, and CISA confirmed exploitation on 1 May. The reviewed sources do not identify victims or establish the scale of attacks, and CISA lists ransomware use as unknown. Upstream kernel fixes and distribution updates are available, with Red Hat reporting all its fixes released. Coverage remains partial: Ubuntu's October tracker still lists its specialist Azure NVIDIA kernel as vulnerable. Users should install their distribution's fixed kernel and restart.

What
Flaw
Affects
Linux kernel on Linux computers, servers and container hosts
Affected
Upstream Linux kernels from 4.14 that lack the relevant fix or backport; kernels before 4.14 are listed as unaffected.
Upstream affected branches before 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.22 and 6.19.12; mainline versions before 7.0.
Ubuntu 24.04 LTS linux-azure-nvidia: tracker still lists vulnerability with work in progress in 6.8.0-1039.42.
Ubuntu distribution kernels require their package-specific fixes; upstream version thresholds do not account for distribution backports.
Fixed in
Upstream Linux 5.10.254
Upstream Linux 5.15.204
Upstream Linux 6.1.170
Upstream Linux 6.6.137
Upstream Linux 6.12.85
Upstream Linux 6.18.22
Upstream Linux 6.19.12
Upstream Linux 7.0
Ubuntu 22.04 LTS standard kernel: 5.15.0-179.189
Ubuntu 22.04 LTS HWE kernel: 6.8.0-117.117~22.04.1
Ubuntu 24.04 LTS standard kernel: 6.8.0-117.117
Ubuntu 24.04 LTS HWE kernel: 6.17.0-29.29~24.04.1
CVE
CVE-2026-31431
Since
1 May 2026

Timeline

  1. Vendor revisedPartly fixed

    Ubuntu's updated tracker lists fixes for standard supported kernels, but still marks Ubuntu 24.04's linux-azure-nvidia package as vulnerable, with work in progress in 6.8.0-1039.42. Ubuntu 26.04 and 26.10 are listed as unaffected.

  2. Vendor revised

    Red Hat's updated bulletin marked the issue resolved and said all its fixes were available.

  3. New fixPartly fixed

    Red Hat released its first product fix, for Red Hat Enterprise Linux 9.

  4. CISA added

    CISA added the flaw to its Known Exploited Vulnerabilities catalogue, confirming use in attacks. It set a 15 May remediation deadline for US federal civilian agencies; ransomware use was listed as unknown.

  5. Update

    Xint published its Copy Fail research, reporting successful administrator takeovers on tested Ubuntu, Amazon Linux, Red Hat Enterprise Linux and SUSE systems.

  6. Made public

    Linux published CVE-2026-31431 for a flaw in its algif_aead cryptographic interface.

  7. New fixPartly fixed

    The fix was committed to the mainline Linux kernel. This did not mean Linux distributions had released updated kernel packages.

  8. UpdateNo fix yet

    The researchers privately reported the vulnerability to the Linux kernel security team.

Sources

  1. Linux CNA record for CVE-2026-31431Linux · 5 Aug 2026
  2. CVE-2026-31431: Ubuntu package statusCanonical · 12 Oct 2026
  3. Fixes available for CVE-2026-31431 (Copy Fail)Canonical · 30 Apr 2026
  4. RHSB-2026-002: Cryptographic Subsystem Privilege Escalation — Copy FailRed Hat · 13 May 2026
  5. Copy Fail: 732 Bytes to Root on Every Major Linux DistributionXint · 29 Apr 2026
  6. High Vulnerability in the Linux Kernel (Copy Fail)CERT-EU · 30 Apr 2026
  7. Known Exploited Vulnerabilities catalogue: CVE-2026-31431CISA · 1 May 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from May 2026 · JSON · RSS