Overview On May 3, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2026‑31431, a critical Linux privilege escalation flaw, to its Known Exploited Vulnerabilities (KEV) catalog. The bug, nicknamed Copy Fail, allows any unprivileged local user to gain root access across affected Linux distributions.
Vulnerability Details
- Type: Local Privilege Escalation (LPE).
- CVSS Score: 7.8.
- Root Cause: Incorrect resource transfer in the Linux kernel’s authentication cryptographic template.
- Exploit: A trivial 732‑byte Python script can reliably trigger escalation.
- Affected Versions: Linux kernels shipped since 2017.
- Fixes Released: Kernel versions 6.18.22, 6.19.12, and 7.0.
Why It Matters
- Page Cache Corruption: Attackers can overwrite in‑memory executables (e.g.,
/usr/bin/su) without touching disk, injecting malicious code at runtime. - Container Risk: Impacts Docker, LXC, and Kubernetes environments where the AF_ALG subsystem is exposed, enabling container escape and host takeover.
- Low Barrier: Exploitation requires no race conditions or memory guessing — only legitimate system calls.
- PoC Availability: Python, Go, and Rust exploit versions are already circulating in open‑source repositories.
Exploitation Status
- Active Exploitation: Confirmed in the wild.
- Detection Difficulty: Exploit blends with normal application behavior.
- Microsoft Defender: Reports preliminary testing activity, warning of likely increased exploitation.
- Attack Vector: Local (AV:L), requiring low privileges and no user interaction. Often chained with SSH access, malicious CI jobs, or compromised containers.
Defensive Guidance
- Patch Immediately: Upgrade to fixed kernel versions.
- Deadline: Federal agencies must patch by May 15, 2026.
- Mitigation:
- Disable affected features if patching isn’t possible.
- Apply strict network isolation.
- Enforce access controls to limit local user exposure.
- Audit: Monitor for unusual privilege escalations and container breakout attempts.
Final Thought
The Copy Fail vulnerability is a stark reminder that long‑standing kernel bugs can resurface as high‑impact threats. With trivial exploits already circulating and active attacks underway, organizations running Linux in cloud or containerized environments must treat this as a priority patch event. Root access from unprivileged contexts is the ultimate compromise — and in containerized deployments, it can mean full host takeover
Leave a Reply