The US Cybersecurity and Infrastructure Security Agency added CVE-2026-31431, a Linux kernel privilege-escalation flaw nicknamed "Copy Fail," to its Known Exploited Vulnerabilities catalog on 1 May 2026, giving Federal Civilian Executive Branch agencies until 15 May to patch every affected system. The vulnerability carries a CVSS score of 7.8 (high) and has been observed under active exploitation in the wild.

The exploit is small enough to fit in a tweet. According to the Cybersecurity News write-up that broke the technical details, "a 732-byte Python script is all an unprivileged local user needs to reliably escalate privileges to root." The flaw lives in the algif_aead module's authentication cryptographic template — used during in-place operations — and chains the AF_ALG socket interface with a splice() system call to achieve a controlled 4-byte kernel-page-cache overwrite that corrupts sensitive binaries.

Affected — essentially everything

The bug was introduced by three individually-harmless commits made to the kernel in 2011, 2015, and 2017. That means every major distribution shipped since 2017 is affected: Ubuntu 24.04 LTS, Amazon Linux 2023, Red Hat Enterprise Linux 10.1, SUSE 16, Debian, Fedora, and Arch Linux. Patches are available in Linux kernel versions 6.18.22, 6.19.12, and 7.0.

Containers and Kubernetes are the soft target

What makes Copy Fail especially dangerous is that the exploit "requires no root privileges inside containers, no kernel modules, and no network access." That combination is precisely the threat model containers were supposed to mitigate. In a multi-tenant Kubernetes cluster running on GKE, EKS, or AKS, a single compromised container can now escape its sandbox via a kernel-host attack path that bypasses every container-level hardening the orchestrator provides.

What to do today

If you run any production Linux host, the patch path is the only acceptable response. The kernel team has backports for the major LTS lines; cloud providers including AWS, GCP and Azure have rolled host-level patches into their managed-Kubernetes control planes — but customer-managed worker nodes and self-hosted Kubernetes clusters need operator action. CISA's federal deadline has passed but the urgency has not: a privileged-escalation primitive of this size will be added to commodity exploit kits within weeks, if it has not been already.

For anyone running self-hosted infrastructure on Exabytes, Linode, DigitalOcean, or smaller regional providers: ask whether kernel-level patching has been applied at the hypervisor host, and patch your VM kernels regardless. The provider patch closes the host-to-host risk; the VM patch closes the in-VM risk.

Why one script works on every distribution

The detail that made Copy Fail unusual is not the size of the exploit but the reason it can be that small. Most Linux privilege-escalation bugs depend on winning a race condition, or on knowing the memory offsets of a particular kernel build, which is why exploit code for them is normally a per-distribution, per-version affair that breaks the moment anything shifts underneath it.

This one is a deterministic logic flaw. It does not race, and it does not need offsets. It grants a narrow, exact primitive — the ability to write four attacker-controlled bytes into the page cache of any file the attacker can read. Four bytes is not much until you consider what is readable on a normal system and what four well-chosen bytes can do to a binary the operating system will later execute with privilege.

Because the mechanism carries no build-specific assumptions, the same unmodified script works on Ubuntu, Amazon Linux, Red Hat Enterprise Linux and SUSE. This is what removed the skill barrier. An exploit requiring offset-tuning is a specialist tool; one that runs anywhere is a commodity.

How seriously the industry took it

The response was unusually broad for a kernel advisory, and that breadth is telling.

Red Hat issued a dedicated security bulletin rather than folding it into routine errata. CERT-EU published a standalone advisory. NHS England sent a cyber alert to its own estate. Microsoft, Wiz, Sysdig and Palo Alto's Unit 42 all published technical analyses within days of disclosure on 29 April. The flaw even acquired a Wikipedia entry, a rough marker that it had crossed out of specialist coverage.

Organisations that treat vendor advisory volume as a prioritisation signal had an unusually clear one here. The sheer number of parties who decided this warranted their own analysis was the industry's closest thing to a consensus severity judgement.

Where this stands three months on

By late August the picture had settled. The May advisories were necessarily immediate; there is now enough distance to look back at what actually happened.

Patches have been available across every major distribution for months and the cloud providers completed their managed control-plane work. What has not appeared in public reporting is the thing the original coverage most expected: no confirmed ransomware campaign or named intrusion has been publicly tied to Copy Fail as the escalation step. That absence is not evidence the flaw went unused. Privilege escalation is the middle of an intrusion rather than its entry point, and incident write-ups routinely name the initial access vector while describing the escalation only in general terms.

A deterministic, universal, commodity-grade root primitive was published, patched quickly, and has not surfaced by name in any public incident. Both halves of that sentence carry equal weight.

Whether you would know if it had been used

The question that follows from an absence of named incidents is whether anyone would be in a position to notice.

The exploit needs no network access, loads no kernel module and spawns nothing unusual at the point of escalation. What it leaves is a modified page-cache entry and, downstream, whatever the attacker did with root — which looks like administrative activity because at that point it is administrative activity. Detection therefore depends on having recorded the surrounding behaviour rather than the escalation itself: unexpected use of the AF_ALG socket interface, a process whose privileges changed without a corresponding authentication event, or a container workload touching host resources it never touched before.

Most organisations do not collect that on their Linux fleet, and those that do rarely retain it for three months. An operator asking today whether they were affected between May and now will usually find the honest answer is that the data required to answer it was never kept. That is worth knowing before the next one, because the retention decision has to be made in advance.

What to check now, which is not what to check in May

The May guidance was to patch. Three months later the useful question is different: which systems did not get patched, and why.

Machines stay vulnerable because they are invisible, not because an administrator refused a patch. Machines that miss a rollout tend to be the ones nobody owns — a build agent stood up for one project, a database replica outside the configuration management inventory, an appliance whose vendor ships its own kernel on its own schedule, a development cluster that was going to be rebuilt anyway.

For operators in this region there is a specific version of that question. Organisations running on regional providers, or on self-managed Kubernetes rather than a managed control plane, own the worker-node kernel themselves. Managed services patched the host; nobody patched the node on your behalf. An honest audit means enumerating running kernel versions across the estate rather than confirming that a patch was published, and those are different exercises with different answers.

Sources and cross-checks: Primary: Cybersecurity News — CISA Warns of Linux "Copy Fail" 0-Day Vulnerability Exploited to Root Systems. Corroborated against: CISA Known Exploited Vulnerabilities Catalog Added in the August 2026 update: Red Hat security bulletin RHSB-2026-002 for the dedicated vendor bulletin; CERT-EU advisory 2026-005 and NHS England cyber alert CC-4776 for the breadth of institutional response; Wiz, Sysdig and Unit 42 for the deterministic-logic-flaw characterisation, the four-byte page-cache write primitive and public disclosure on 29 April 2026. No public reporting reviewed in August 2026 names Copy Fail as the escalation step in a specific intrusion or ransomware campaign; that absence is reported as an absence, not as evidence the flaw was unused. and The Hacker News KEV reporting. CVE-2026-31431 catalog entry verified 18 May 2026.