U.S. cybersecurity agency CISA says the CopyFail bug is being actively used in hacking campaigns, and poses a major risk to servers and datacenters that rely on Linux.
U.S. cybersecurity agency CISA says the CopyFail bug is being actively used in hacking campaigns, and poses a major risk to servers and datacenters that rely on Linux.
Security researchers from Theori released exploit code for CVE-2026-31431, a critical Linux kernel vulnerability allowing unprivileged users to gain root access. The flaw, named CopyFail, affects virtually all Linux distributions and works with a single Python script across Ubuntu 22.04, Amazon Linux 2023, SUSE 15.6, and Debian 12. The vulnerability stems from a logic flaw in the kernel's crypto API, not race conditions or memory corruption, making it highly reliable. Private disclosure occurred five weeks prior, but most distributions had not patched when the exploit went public.
