CISA Adds CVE‑2026‑31431 (Copy Fail) to KEV — Local Root Risk

Colleagues, please note: CISA has added CVE‑2026‑31431 (Copy Fail) to the KEV — signs of active exploitation.

Summary: local privilege escalation (CVSS 7.8). An unprivileged user can gain root by corrupting the page cache.

Fixes: kernel updates 6.18.22, 6.19.12 and 7.0. Vulnerability stems from changes made in 2011–2017 and affects distributions released since 2017.

Cloud risk: PoCs exist in Python/Go/Rust; containers using AF_ALG/algif_aead are vulnerable — isolation can be lost, enabling host escape.

Why it matters: ease of exploitation and public PoCs increase compromise risk.

How are you accelerating patching and mitigating exposure?

#cybersecurity #Linux #containers #vulnerabilities