The U.S. Cybersecurity and Infrastructure Security Agency added the Linux kernel vulnerability known as Copy Fail to its Known Exploited Vulnerabilities catalog on May 1, 2026, citing evidence of active exploitation.
Tracked as CVE-2026-31431, the flaw allows an unprivileged local user to gain root privileges on a vulnerable system. Exploitation requires the ability to execute code locally with access to the affected kernel cryptographic interface; the vulnerability does not provide remote access by itself.
CISA was reported to have set a May 15, 2026, remediation deadline for Federal Civilian Executive Branch agencies under Binding Operational Directive 22-01. Its May 1 announcement said the directive applied to those agencies and urged other organizations to prioritize remediation of vulnerabilities in the catalog.
The agency’s alert did not identify attackers, victims or the scale of exploitation. In a May 1 analysis, Microsoft described exploitation as limited and primarily observed in proof-of-concept testing.
How Copy Fail affects Linux systems
The vulnerability involves algif_aead, part of the AF_ALG interface that exposes kernel cryptographic functions to userspace programs. Theori researchers described a technique that lets an unprivileged user write four controlled bytes into the page cache of a readable file. They said repeated writes could alter the cached contents of a privileged executable and allow it to run attacker-controlled code with root privileges.
Theori reported successful exploitation on Ubuntu 24.04 LTS, Amazon Linux 2023, Red Hat Enterprise Linux 10.1 and SUSE 16. Those tests do not establish that every installation of those distributions is vulnerable: exposure depends on the running kernel, distribution backports and access to the affected functionality.
The researchers said the modification affects the cached version of a file without changing its contents on disk, so checks that examine only the on-disk contents can miss it. Microsoft also identified potential container-breakout scenarios in environments where containers share a vulnerable host kernel.
The local-execution requirement makes the flaw relevant to shared servers, container hosts and build systems that run code under restricted accounts. Microsoft identified SSH access, malicious CI jobs and container footholds as possible ways an attacker could obtain the local execution needed to exploit it.
Kernel fixes and vendor response
The Linux kernel CVE team’s April 22 notice identified the change that introduced the issue in Linux 4.14 in 2017. It listed fixes in kernel versions 6.18.22, 6.19.12 and 7.0, while noting that fixes could be backported to other supported versions. Distribution-specific patch status therefore cannot be determined from the upstream version number alone.
The fix removes the affected in-place cryptographic operation and separates the source and destination buffers. The kernel CVE team recommended updating to a current stable release and said cherry-picking individual fixes was neither recommended nor supported by the kernel community.
Remediation also depends on the vendor and kernel build. Amazon’s security records list live-patch fixes dated May 4 for selected Amazon Linux 2 and Amazon Linux 2023 kernels. Amazon also documented disabling the algif_aead module as a mitigation, with a different procedure requiring a reboot for some Amazon Linux 2 ARM64 systems where the module is built into the kernel.
