- A critical Linux kernel flaw, CVE-2026-31431, now has publicly released exploit code giving attackers full control over vulnerable systems.
- The US government confirms active exploitation in the wild, with CISA ordering all civilian federal agencies to patch by May 15.
- The bug affects nearly every Linux distribution released since 2017, including Red Hat, Ubuntu, Amazon Linux, Kubernetes, and more.
A critical security flaw in the Linux operating system has put defenders on high alert and sent system administrators racing to apply patches. Security researchers released working exploit code for the vulnerability publicly, and the move handed attackers a ready-made tool to seize complete control of vulnerable systems.
The US government confirmed the bug is already under active exploitation. Real hacking campaigns are currently deploying CopyFail against live targets, and the window for a safe response is closing fast.
Nearly Every Modern Linux Distribution is at Risk
Researchers track the vulnerability officially as CVE-2026-31431. It affects Linux kernel versions 7.0 and earlier. Security firm Theori, which first discovered CopyFail, verified the flaw across several widely used Linux distributions, including Red Hat Enterprise Linux 10.1, Ubuntu 24.04 LTS, Amazon Linux 2023, and SUSE 16.
The Linux kernel security team received the initial disclosure in late March and released a patch within about a week. But many Linux distributions relying on the affected kernel have not yet fully delivered that fix to end users, leaving a significant number of systems still exposed and at risk.
DevOps engineer Jorijn Schrijvershof confirmed in a blog post that the exploit also works on Debian, Fedora, and Kubernetes environments. According to Schrijvershof, the flaw carries an unusually wide blast radius because it functions across nearly every modern Linux distribution. The CopyFail project website states that a short Python script can grant root access to every Linux distribution shipped since 2017.
Linux powers a substantial portion of the world’s enterprise infrastructure, running the servers and data centers that keep businesses and governments operating globally. That reach makes this vulnerability especially dangerous.
Government systems are prime targets. In a recent dark web listing, a hacker claimed to be selling stolen data from a Bangladesh government ministry, a reminder of what’s at stake when security gaps go unpatched.
A Kernel Flaw That Hands Attackers Full System Control
The name “CopyFail” comes directly from how the bug operates. The affected component inside the Linux kernel fails to copy certain data when it should. That failure corrupts sensitive data within the kernel, and an attacker can exploit that corruption to ride the kernel’s privileged access across the entire system, reaching stored data, running applications, and connected infrastructure.
The most damaging consequence is privilege escalation. A standard, limited-permission user account on a vulnerable system can use CopyFail to gain full root (administrator) access. In a data center environment, one compromised server can expose every application, database, and client account within that infrastructure, and potentially breach other systems on the same network.
CopyFail does not travel over the internet on its own. But Microsoft warns that pairing it with a separate, internet-facing exploit creates a highly dangerous attack chain. According to Microsoft, combining CopyFail with a remotely exploitable flaw allows an attacker to gain root access to a targeted server without any direct access at all. A regular user on a vulnerable machine could also trigger the exploit by opening a malicious link or file attachment.
Supply chain attacks present yet another delivery method. Threat actors can compromise an open-source developer’s account and embed the exploit inside widely distributed code, infecting a large number of devices through a single, coordinated operation.
CISA Orders Federal Agencies to Patch by May 15
CISA added CopyFail to its Known Exploited Vulnerabilities catalog and ordered all civilian federal agencies to patch affected systems by May 15. The urgency reflects how seriously the agency views the threat to government infrastructure.
Security teams in any organization running Linux need to prioritize kernel updates immediately. Monitoring systems for unusual privilege escalation activity and restricting unnecessary user permissions reduces exposure while patches work their way through distribution pipelines.
The public release of working exploit code has significantly lowered the barrier for attackers. Tools that once required sophisticated, well-funded groups to develop are now within reach of far less skilled actors. For any Linux environment handling sensitive data or critical services, delayed patching is no longer an acceptable risk.
