Full Breakdown
CISA Flags Actively Exploited Linux Copy-Fail Vulnerability
5/4/2026, 11:38:01 AM
Core Event: CISA Adds CVE-2026-31431 to KEV Catalog
On 3 May 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Linux kernel privilege-escalation flaw CVE-2026-31431 to its Known Exploited Vulnerabilities (KEV) catalog, citing “evidence of active exploitation.” The advisory urges patching.
Background & Context
The “Copy Fail” flaw stems from a logic error in the kernel’s cryptographic template introduced by three changes in 2011, 2015 and 2017. Theori researchers disclosed a 732-byte Python exploit that triggers the bug. The flaw affects Linux kernels released since 2017 and has a CVSS score of 7.8.
Key Figures, Groups, and Data
CISA set a 15 May 2026 patch deadline. Theori discovered the bug; Wiz explained the page-cache manipulation; Kaspersky warned about container breach via AF_ALG; Microsoft Defender reported early testing. Linux vendors released fixes in kernels 6.18.22, 6.19.12, 7.0. The exploit payload is 732 bytes.
Impact, Risks, and Vulnerabilities
Linux powers cloud servers and container platforms (Docker, LXC, Kubernetes). Corrupting the in-memory page cache of any readable file—including setuid binaries—lets attackers inject code into binaries without touching disk, achieving silent root takeover. Servers and developer workstations are vulnerable. No mitigation exists beyond patching, and detection is hard because the exploit uses only legitimate system calls.
Official Statements & Responses
CISA called the flaw “an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.” Microsoft Defender said the local attack requires no user interaction and is dangerous when chained with SSH or compromised CI jobs. Wiz noted page-cache modification rewrites binaries at execution time. Kaspersky warned the issue can let attackers control the host from within containers. Federal agencies must apply patches immediately; interim mitigations are limited to disabling the feature and tightening network isolation.
Conflicting Reports & Gaps
CISA did not disclose specific exploitation details, while Microsoft Defender reported only “preliminary testing activity.” The scale of active exploitation in the wild remains unquantified.
Verbatim Quotes
- “Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation,” — CISA
- “At the same time, exploitation does not require the use of complex techniques, such as race conditions or memory address guessing, which lowers the entry barrier for a potential attacker.” — Microsoft
- “Detecting the attack is difficult because the exploit uses only legitimate system calls, which are hard to distinguish from normal application behavior.” — Microsoft
- “The agency stated that the decision was based on “evidence of active exploitation,” underscoring the immediate risk posed by this issue.” — CISA
Criticism & Opposition
Analysts note the lack of mitigation beyond patching and the ease of detection evasion raise the threat for organizations unable to update promptly.
What’s Next
FCEB agencies must install kernel updates by 15 May 2026. Users should verify patch deployment, disable the vulnerable AF_ALG subsystem where feasible, enforce network segmentation, and monitor for anomalous legitimate-call usage. Threat intel will monitor exploitation growth.
