Search/CVE-2026-31431
● CVE — High

CVE-2026-31431

Vendordebian, suse, linux, canonical, redhatProductdebian linux, linux enterprise desktop, linux kernel, ubuntu linux, enterprise linux, enterprise linux eus, enterprise linux update services for sap solutions, openshift container platform, leap, caas platform, linux enterprise high availability extension, linux enterprise live patching, openstack cloud, enterprise linux aus, enterprise linux tus, openstack cloud crowbar, linux enterprise high performance computing, enterprise storage, manager proxy, manager retail branch server, manager server, amazon linux, basesystem module, development tools module, legacy moduleDiscoveredApr 22, 2026UpdatedSep 8, 2026

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

View graph Watch Export
CVSS v3.1
7.8 HIGH
EPSS
98.1%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
74
sources referencing this CVE
Related IOCs
10
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Oct 26, 2026
▼ 1.79pp
99.9% → 98.1% over 3 tracked changes
CVSS v3.1 Detail
Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Connections
107 relationships
Timeline
disclosure → media coverage
Apr 22, 2026
Disclosure — published as a CVE record. · last revised by NVD Sep 8, 2026
Apr 30, 2026
thehackernews.com reports: New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions
Apr 30, 2026
securityweek.com reports: ‘Copy Fail’ Logic Flaw in Linux Kernel Enables System Takeover
Apr 30, 2026
acn.gov.it reports: Linux: disponibile PoC per lo sfruttamento della CVE-2026-31431
Apr 30, 2026
securityweek.com reports: Critical cPanel & WHM Vulnerability Exploited as Zero-Day for Months
Apr 30, 2026
cert.europa.eu reports: 2026-005: High Vulnerability in the Linux Kernel ("Copy Fail")
Apr 30, 2026
bleepingcomputer.com reports: New Linux ‘Copy Fail’ flaw gives hackers root on major distros
May 1, 2026
atmarkit.itmedia.co.jp reports: LinuxカーネルのゼロデイをAIが発見　悪用で簡単にroot権限奪取が可能に
May 1, 2026
infosecurity-magazine.com reports: Nine-Year-Old Zero-Day Flaw in Linux Kernel Discovered by AI-Equipped Security Researcher
May 3, 2026
thehackernews.com reports: CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV
May 3, 2026
helpnetsecurity.com reports: Week in review: High-severity LPE vulnerability in the Linux kernel, cPanel 0-day exploited for months
May 4, 2026
securityweek.com reports: Exploitation of ‘Copy Fail’ Linux Vulnerability Begins
May 4, 2026
bleepingcomputer.com reports: CISA says ‘Copy Fail’ flaw now exploited to root Linux systems
May 4, 2026
thehackernews.com reports: ⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE & More
May 5, 2026
securityweek.com reports: MetInfo, Weaver E-cology Vulnerabilities in Attackers’ Crosshairs
May 5, 2026
unit42.paloaltonetworks.com reports: Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years
May 6, 2026
securityweek.com reports: Palo Alto Networks to Patch Zero-Day Exploited to Hack Firewalls
May 6, 2026
securityweek.com reports: Sophisticated Quasar Linux RAT Targets Software Developers
May 8, 2026
thehackernews.com reports: Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions
May 8, 2026
bleepingcomputer.com reports: New Linux 'Dirty Frag' zero-day gives root on all major distros
May 8, 2026
isc.sans.edu reports: Another Universal Linux Local Privilege Escalation (LPE) Vulnerability: Dirty Frag, (Fri, May 8th)
May 8, 2026
acn.gov.it reports: Dirty Frag: rilevata PoC per l'elevazione di privilegi in Linux - CVE-2026-43284
May 8, 2026
helpnetsecurity.com reports: Dirty Frag: Unpatched Linux vulnerability delivers root access
May 11, 2026
securityweek.com reports: New ‘Dirty Frag’ Linux Vulnerability Possibly Exploited in Attacks
May 11, 2026
therecord.media reports: Dirty Frag: Linux kernel hit by second major security flaw in two weeks
May 11, 2026
helpnetsecurity.com reports: Linux developers weigh emergency “killswitch” for vulnerable kernel functions
May 11, 2026
infosecurity-magazine.com reports: Rushed Patches Follow Broken Embargo on New Linux Kernel Vulnerabilities
May 11, 2026
darkreading.com reports: 'Dirty Frag' Exploit Poised to Blow Up on Enterprise Linux Distros
May 11, 2026
itmedia.co.jp reports: はてな、マネフォ、そしてLinuxの脆弱性「Copy Fail」を読み解く　“見えている落とし穴”を避けるには
May 11, 2026
atmarkit.itmedia.co.jp reports: Linux主要配布版にroot権限奪取の恐れ　ゼロデイ脆弱性「Dirty Frag」公開
May 12, 2026
schneier.com reports: Copy.Fail Linux Vulnerability
May 13, 2026
therecord.media reports: Microsoft on pace to break annual vulnerability record as AI-driven patch wave takes hold
May 14, 2026
thehackernews.com reports: New Fragnesia Linux Kernel LPE Grants Root Access via Page Cache Corruption
May 14, 2026
bleepingcomputer.com reports: New Fragnesia Linux flaw lets attackers gain root privileges
May 14, 2026
cybersecurity360.it reports: Fragnesia, la nuova falla nel kernel Linux che regala privilegi di root: come difendersi
May 14, 2026
infosecurity-magazine.com reports: New Fragnesia Flaw Hands Linux Local Users Root Access
May 14, 2026
securityweek.com reports: New Linux Kernel Vulnerability Fragnesia Allows Root Privilege Escalation
May 14, 2026
helpnetsecurity.com reports: Fragnesia: New Linux kernel LPE bug was spawned by Dirty Frag patch (CVE-2026-46300)
May 14, 2026
acn.gov.it reports: Fragnesia: PoC per lo sfruttamento di una nuova vulnerabilità nel kernel Linux
May 18, 2026
bleepingcomputer.com reports: Exploit available for new DirtyDecrypt Linux root escalation flaw
May 19, 2026
securityweek.com reports: PoC Released for DirtyDecrypt Linux Kernel Vulnerability
May 19, 2026
thehackernews.com reports: DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability
May 19, 2026
ubuntu.com reports: USN-8277-1: Linux kernel vulnerabilities
May 19, 2026
ubuntu.com reports: USN-8278-1: Linux kernel vulnerabilities
May 19, 2026
ubuntu.com reports: USN-8279-1: Linux kernel vulnerabilities
May 19, 2026
ubuntu.com reports: USN-8280-1: Linux kernel vulnerabilities
May 19, 2026
ubuntu.com reports: USN-8281-1: Linux kernel vulnerabilities
May 20, 2026
bleepingcomputer.com reports: Exploit released for new PinTheft Arch Linux root escalation flaw
May 20, 2026
ubuntu.com reports: USN-8289-1: Linux kernel (NVIDIA) vulnerabilities
May 21, 2026
thehackernews.com reports: 9-Year-Old Linux Kernel Flaw Enables Root Command Execution on Major Distros
May 21, 2026
infosecurity-magazine.com reports: Nine-Year-Old Linux Kernel Flaw Leaks SSH Keys and Password Hashes
May 22, 2026
ubuntu.com reports: USN-8277-2: Linux kernel (Oracle) vulnerabilities
May 22, 2026
ubuntu.com reports: USN-8279-2: Linux kernel (GCP) vulnerabilities
May 23, 2026
theregister.com reports: Dirty Frag, Copy Fail, Fragnesia: The start of a worrisome Linux security trend
May 25, 2026
ubuntu.com reports: USN-8279-3: Linux kernel (NVIDIA Tegra IGX) vulnerabilities
May 25, 2026
ubuntu.com reports: USN-8305-1: Linux kernel (Intel IoTG Real-time) vulnerabilities
May 26, 2026
ubuntu.com reports: USN-8310-1: Linux kernel (Azure) vulnerabilities
May 26, 2026
ubuntu.com reports: USN-8278-2: Linux kernel (Azure) vulnerabilities
May 26, 2026
ubuntu.com reports: USN-8305-2: Linux kernel (Low Latency) vulnerabilities
May 26, 2026
ubuntu.com reports: USN-8280-3: Linux kernel (IoT) vulnerabilities
May 30, 2026
bleepingcomputer.com reports: New CIFSwitch Linux flaw gives root on multiple distributions
Jun 1, 2026
securityweek.com reports: 19-Year-Old Linux Kernel Vulnerability Exposes Systems to Root Access
Jun 2, 2026
ubuntu.com reports: USN-8374-1: Linux kernel vulnerabilities
Jun 3, 2026
helpnetsecurity.com reports: Autonomous AI-driven worm can reason its way through corporate networks
Jun 11, 2026
ubuntu.com reports: USN-8426-1: Linux kernel (Azure) vulnerabilities
Jun 29, 2026
securityweek.com reports: ‘DirtyClone’ Linux Kernel Vulnerability Leads to Root Access
Jul 2, 2026
ubuntu.com reports: USN-8499-1: Linux kernel (Xilinx) vulnerabilities
Jul 3, 2026
thehackernews.com reports: New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android
Jul 10, 2026
ubuntu.com reports: USN-8528-1: Linux kernel (Xilinx ZynqMP) vulnerabilities
Aug 26, 2026
securelist.com reports: Exploits and vulnerabilities in Q2 2026
Aug 27, 2026
ubuntu.com reports: LSN-0121-1: Kernel Live Patch Security Notice
Sep 23, 2026
bleepingcomputer.com reports: InfraTrust report warns network management systems under attack
Sep 29, 2026
aws.amazon.com reports: Dirty Frag and other issues in Amazon Linux kernels
Sep 29, 2026
aws.amazon.com reports: CVE-2026-31431
Oct 28, 2026
bleepingcomputer.com reports: InfraTrust report warns of exploited flaws in critical network infrastructure
Public PoC (10)
github.com/John-Popovici/CVE-2026-31431-CopyFail-Linux-PrivEscgithub.com/theori-io/copy-fail-CVE-2026-31431github.com/Alfredooe/CVE-2026-31431github.com/painoob/Copy-Fail-Exploit-CVE-2026-31431github.com/badsectorlabs/copyfail-gogithub.com/tgies/copy-fail-cgithub.com/ZephrFish/CopyFail-CVE-2026-31431github.com/Crihexe/copy-fail-tiny-elf-CVE-2026-31431github.com/b5null/CVE-2026-31431-Cgithub.com/Percivalll/Copy-Fail-CVE-2026-31431-Statically-PoC
Unverified third-party code — review before executing.