CISA is warning that threat actors are actively exploiting a recently disclosed Linux kernel vulnerability known as “Copy Fail,” tracked as CVE-2026-31431. Multiple outlets report that the flaw is a local privilege escalation that can allow an attacker to gain root access on affected systems.
Bleeping Computer and The Register say CISA’s advisory follows closely after researchers from Theori publicly disclosed the issue and released a proof-of-concept exploit. Naked Security also reports that a working PoC is available for CVE-2026-31431.
Bruce Schneier describes technical details of the underlying issue, including that it involves misuse of the kernel crypto API (AF_ALG sockets) together with splice() to write small amounts of data into the page cache of a file the attacker does not own. Schneier also states that the exploit does not rely on race conditions or per-distro offsets and that it works across multiple major Linux distributions.
Across the sources, the key shared point is that exploitation in the wild begins shortly after the vulnerability and PoC become public, prompting CISA to issue an alert.
