The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Linux kernel vulnerability, dubbed Copy Fail and assigned CVE-2026-31431, to its Known Exploited Vulnerabilities catalog after reports of active attacks. This flaw, which impacts major Linux distributions released since 2017, allows local privilege escalation—meaning attackers must already have some level of code access to the targeted system before they can leverage this bug to gain root privileges.
Security researchers from Theori and Xint Code traced the issue to the kernel’s cryptographic subsystem, explaining that the vulnerability enables corruption of the in-memory page cache of readable files, including those containing privileged binaries. The exploit is alarmingly simple; researcher Miguel Angel Duran noted that as few as ten lines of Python code could suffice to achieve root-level control on vulnerable systems.
CISA’s inclusion of Copy Fail in its catalog triggers a mandatory remediation timeline for federal civilian agencies, but private organizations also frequently use this list to prioritize patching—especially when public exploit code is circulating. The flaw does not provide remote access by itself, yet it poses significant risks for environments where Linux servers underpin critical operations, such as cryptocurrency exchanges, blockchain nodes, validators, and cloud trading platforms.
While Copy Fail does not directly target crypto wallets or blockchains, it amplifies danger if an attacker first compromises a Linux server through other means and then uses this vulnerability to escalate privileges to root. Theori CEO Brian Pak disclosed that the vulnerability was reported privately to the Linux kernel security team on March 23, with patches integrated into the mainline kernel by April 1 and a CVE assigned on April 22.
Security experts, including those at Sophos, emphasize that organizations should promptly apply patched kernels, especially for multi-tenant Linux hosts and container platforms, given that proof-of-concept exploit code is now publicly available. Microsoft also warned that the flaw could affect cloud workloads and Kubernetes environments, underscoring the broad exposure across enterprise infrastructure.
As Copy Fail continues to be exploited, companies reliant on Linux must scrutinize their exposure and expedite patch deployment to mitigate the risk of privilege escalation attacks that could lead to full system compromise.