Copy Fail Lands In CISA KEV As Actively Exploited Linux Flaw Threatens Widespread Privilege Escalation
The Cybersecurity and Infrastructure Security Agency (CISA) has added another Linux kernel vulnerability, CVE-2026-31431, also known as Copy Fail, to the Known Exploited Vulnerabilities (KEVs).
Inclusion in the list implies active real-world attacks and increases the priority of patches.
This particular vulnerability, which has been affecting almost all major Linux distributions since 2017, involves transferring resources incorrectly between security domains and allows local users to escalate privileges to root access.
Experts emphasize the danger associated with this vulnerability, especially because of its reliability, undetectability, and cross-environment nature. Threat actors can abuse this vulnerability to tamper with memory data without any traces on the disk.
Microsoft researchers said they have observed only limited in-the-wild exploitation, mainly surrounding proof-of-concept (PoC) testing. However, despite the minimal current activity targeting it, CVE-2026-31431 has broad applicability, and a working PoC exploit has been released, which should raise concern among defenders.
“Successful exploitation leads to...
Copyright of this story solely belongs to informationsecuritybuzz.com. To see the full text click HERE
