CISA adds Linux Copy Fail flaw to exploited bug list

A newly disclosed Linux security flaw has drawn attention from U.S. cyber officials after researchers warned that attackers could use a small Python script to gain root access on affected systems.

The flaw, known as Copy Fail and tracked as CVE-2026-31431, affects many Linux distributions released since 2017. CISA has added the bug to its Known Exploited Vulnerabilities catalog, citing active exploitation risk. 

Copy Fail is a local privilege escalation bug in the Linux kernel. It does not give remote access by itself. An attacker must already have code execution on the system before using the flaw to gain root rights.

Security researchers said the flaw affects major Linux distributions, including Ubuntu, Red Hat, SUSE, and Amazon Linux. Microsoft also warned that the bug could affect cloud workloads and Kubernetes environments. 

Researchers warn about simple exploit path

Theori and Xint Code linked the issue to the Linux kernel’s crypto subsystem. Researchers said the bug allows an attacker to corrupt the in-memory page cache of readable files, including privileged binaries. 

Researcher Miguel Angel Duran described the exploit as unusually simple, saying, “10 lines of Python” may be enough to gain root access on affected systems. Another researcher called the flaw “insane,” reflecting concern over how small the exploit can be.

Moreover, CISA added CVE-2026-31431 to its Known Exploited Vulnerabilities catalog on May 1. The agency said the Linux kernel contains an incorrect resource transfer flaw that can allow privilege escalation. 

The KEV listing means federal civilian agencies must follow CISA’s remediation timeline. Private companies also often use the catalog to rank patching work, especially when public exploit code exists.

Crypto firms may review Linux exposure

Linux powers many crypto exchanges, blockchain nodes, validators, custodians, and cloud-based trading systems. That makes patching important for firms that run critical infrastructure on affected distributions.

The flaw does not directly target crypto wallets or blockchains. However, it could create risk if an attacker first gains access to a Linux server and then uses Copy Fail to obtain root control.

Theori CEO Brian Pak said the team reported the vulnerability privately to the Linux kernel security team on March 23. Patches reached the mainline kernel on April 1, while the CVE was assigned on April 22. 

Security firms have urged users to apply patched kernels where available. Sophos said public proof-of-concept exploit code exists and organizations should prioritize fixes for multi-tenant Linux hosts and container platforms.