CISA Adds CVE-2026-31431 to Known Exploited Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency added a Linux kernel vulnerability, tracked as CVE-2026-31431 and known as Copy Fail, to its Known Exploited Vulnerabilities catalog on Friday, confirming active exploitation in the wild. The flaw affects major Linux distributions released since 2017, including Ubuntu 24.04 LTS, Amazon Linux 2023, Red Hat Enterprise Linux 10.1 and SUSE 16, allowing unprivileged local users to escalate privileges to root level.

Discovered by researchers at Theori and Xint Code, the vulnerability stems from a logic error in the kernel's AF_ALG interface for the authencesn AEAD cryptographic template. It enables attackers to write four controlled bytes into the in-memory page cache of any readable file, such as setuid-root binaries like /usr/bin/su, without altering the disk file. This permits execution of modified code with root privileges. A 732-byte Python proof-of-concept exploit, described by researchers as 100 percent reliable, works unmodified across affected distributions and kernel versions from around 6.12 to 6.18. Theori noted that the issue arose from kernel changes in 2011, 2015 and 2017.

The vulnerability was privately reported...