Trending Now - CISA Flags Critical Linux Vulnerability for Immediate Attention

WHO:

The Hacker News - U.S. Cybersecurity and Infrastructure Security Agency (CISA)

The Hacker News - Microsoft Defender Security Research Team

The Hacker News - Kaspersky

Cointelegraph - Researchers

WHAT:

The Hacker News - CISA added a security flaw tracked as CVE-2026-31431 to its Known Exploited Vulnerabilities (KEV) catalog.

The Hacker News - The vulnerability has a CVSS score of 7.8 and is a local privilege escalation (LPE) flaw.

The Hacker News - The flaw allows an unprivileged local user to obtain root access.

The Hacker News - The vulnerability is also known as Copy Fail and has been actively exploited.

The Hacker News - Fixes have been made available in Linux kernel versions 6.18.22, 6.19.12, and 7.0.

Cointelegraph - Malicious actors can gain root access on Linux systems using as few as 10 lines of Python.

WHERE:

The Hacker News - The vulnerability impacts various Linux distributions shipped since 2017.

The Hacker News - The flaw poses a risk to containerized environments, including Docker, LXC, and Kubernetes.

WHEN:

The Hacker News - Federal Civilian Executive Branch (FCEB) agencies have been advised to apply fixes by May 15, 2026.

WHY:

The Hacker News - The vulnerability allows for privilege escalation by corrupting the kernel's in-memory page cache of any readable file.

The Hacker News - The flaw was introduced through three separate changes to the Linux kernel made in 2011, 2015, and 2017.

HOW:

The Hacker News - The exploit uses a 732-byte Python-based trigger to escalate privileges.

The Hacker News - The attack vector is local and requires low privileges with no user interaction.

The Hacker News - The exploit performs a controlled 4-byte overwrite in the kernel page cache, leading to corruption of sensitive kernel-managed data.

(UPDATED May 3, 2026 13:17 UTC)

The U.S. Cybersecurity and Infrastructure Security Agency, or CISA, has added a serious security flaw, tracked as CVE-2026-31431, to its Known Exploited Vulnerabilities catalog, which has a CVSS score of 7.8 and allows unprivileged local users to gain root access on various Linux distributions. Known as Copy Fail, this vulnerability has been actively exploited and poses risks to containerized environments like Docker and Kubernetes, prompting federal agencies to apply fixes by May 15, 2026. The exploit requires only a few lines of Python code and can escalate privileges through a controlled overwrite in the kernel's page cache, corrupting sensitive data without needing user interaction.