CVE-2026-31431

Less than two weeks after the public disclosure of the Copy Fail vulnerability (CVE-2026-31431), another local privilege escalation (LPE) vulnerability in the Linux kernel has been revealed. Referred to as "Dirty Frag," this vulnerability was discovered and reported by Hyunwoo Kim (@v4bel) [1]. In this diary, I will provide a brief background on Dirty Frag, and discuss its relationship to Copy Fail. I will then discuss how to mitigate Dirty Frag and outline recommended next steps for system owners. [xlite_meta score:54 src:SANS ISC xlite_fp:b146e17a40fb95dd247ef1477a8785be186d94194ccd42b26a7570e3d9076886]

Details have emerged about a new, unpatched local privilege escalation (LPE) vulnerability impacting the Linux kernel. Dubbed Dirty Frag, it has been described as a successor to Copy Fail (CVE-2026-31431, CVSS score: 7.8), a recently disclosed LPE flaw impacting the Linux kernel that has since come under active exploitation in the wild. The vulnerability was reported to Linux kernel maintainers [xlite_meta score:50 src:The Hacker News xlite_fp:10397330961e2566fe30ad59e12dfd9e088b70f257d6c9f77c78eb93d0a63f1a]

Copy Fail (CVE-2026-31431) is a critical Linux kernel LPE that allows stealthy root access. This flaw impacts millions of systems. Read our analysis. The post Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years appeared first on Unit 42. [xlite_meta score:38 src:Palo Alto Unit 42 xlite_fp:b0647c252d2b14b6ef1e5d1ede7c2ede60e9690afd8c9f0f8840b255ece84718]

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a recently disclosed security flaw impacting various Linux distributions to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The vulnerability, tracked as CVE-2026-31431 (CVSS score: 7.8), is a case of local privilege escalation (LPE) flaw that could allow an [xlite_meta score:59 src:The Hacker News xlite_fp:f731480d11cef7640a9d029860fe2890eb64aa2b07bcda55f4147f51baa30850]

A high-severity Linux vulnerability, “Copy Fail” (CVE-2026-31431), enables root privilege escalation across cloud environments and Kubernetes workloads. With a working exploit already in the wild, organizations should act quickly to detect, mitigate, and reduce risk. The post CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments appeared first on Microsoft Security Blog. [xlite_meta score:64 src:Microsoft Security Blog xlite_fp:33e38d639fbdf69e8d7ea4afc9f46607cfcb8a55bf3259705364ad1525515236]

The exploit, dubbed CopyFail and tracked as CVE-2026-31431, allows hackers to take over PCs and data center servers. The Linux vulnerabilities have been patched—but many machines remain at risk.

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-31431 Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB ne [xlite_meta score:48 src:CISA Alerts xlite_fp:18c58f54ea876d7901e27aa8dddc46f6ad92632cf9b4251ab50869dbc5b71df5]

Categories: Threat Research Tags: advisory, Linux, Copy Fail [xlite_meta score:36 src:Sophos X-Ops xlite_fp:fe5932324077725b70e4eabc79eee3cced15b71892045295c00df4d8ddb27fe0]