2026-005: High Vulnerability in the Linux Kernel ("Copy Fail")
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
On 29 April 2026, a high local privilege escalation vulnerability in the Linux kernel, tracked as CVE-2026-31431 and named "Copy Fail", was publicly disclosed. The vulnerability affects every mainstream Linux distributions shipping a kernel built since 2017. A public proof-of-concept exploit has been released. As of the date of this advisory, no distribution has shipped a fixed kernel package. The mainline fix was committed on 1 April 2026, but vendor updates are still pending across all major distributions. CERT-EU strongly recommends applying the interim mitigation immediately, prioritising Kubernetes nodes, and CI/CD runners exposed to untrusted workloads.
CSIRTS triage
- What
- The vulnerability allows for local privilege escalation due to a flaw in the kernel's functionality.
- Who is affected
- Every mainstream Linux distribution shipping a kernel built since 2017 is affected.
- Urgency
- Remediation is urgent as a public proof-of-concept exploit is available and no fixed kernel package has been shipped yet.
- Action
- Apply the interim mitigation immediately, prioritizing Kubernetes nodes and CI/CD runners.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Linux Kernel
Get an email when a new Linux Kernel advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://cert.europa.eu/publications/security-advisories/2026-005/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-31431Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 100% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-31431 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[UPDATE] [high] Linux Kernel: Multiple vulnerabilitiescert-bund
- high[UPDATE] [high] Linux Kernel (Dirty Frag): Multiple vulnerabilities allow gaining administrator rightscert-bund
- unknownexploitedUSN-8528-1: Linux kernel (Xilinx ZynqMP) vulnerabilitiesubuntu
- unknownMultiple vulnerabilities in Red Hat Linux kernel (July 3, 2026)cert-fr-avis
- unknownRedHat Linux Kernel Multiple Vulnerabilitieshkcert
- unknownMultiple vulnerabilities in the Ubuntu Linux kernel (June 26, 2026)cert-fr-avis
- criticalexploitedImpact of Linux Kernel vulnerabilities on B&R productscisa
- unknownexploitedCVE-2026-31431aws
- unknownexploitedDirty Frag and other issues in Amazon Linux kernelsaws
- unknownOngoing updates on Copy.fail and variantsaws
- unknownexploitedLinux Kernel Vulnerability copy.fail - CVE-2026-31431fortinet
- criticalexploitedCVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerabilitycisa-kev
Recent advisories for 2026-005
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- criticalDrupal core - Critical - PHP object injection - SA-CORE-2026-005drupal · 2026-06-17
More from CERT-EU Security Advisories
- critical2026-008: Critical vulnerabilities in Ivanti Sentry2026-06-10
- critical2026-007: Critical Vulnerability in Windows Netlogon2026-06-10
- critical2026-006: Critical Vulnerability in PAN-OS2026-05-06
- critical2026-004: Critical Vulnerability in SharePoint Exploited2026-03-25
- unknown2026-003: Multiple Vulnerabilities in Citrix NetScaler and Citrix ADC2026-03-23