Signal

New 'Copy Fail' Linux kernel flaw allows local attackers to gain root access

Evidence first: scan the strongest sources, then decide whether to go deeper.

rss

cvelinuxkernellocal_privilege_escalationvulnerabilityexploit

Trend in the last 24h

Current brief openSource links open

This current signal is open on the public brief with summary, metadata, source links, and full evidence. Pro adds compare-over-time, alerts, exports, and workflow.

Back Evidence (9)Get the free brief by email Start free trial

No card needed for the free brief.

Evidence trail (top sources)

top sources (4 domains)

4 top sources shown

‘Trivial’ exploit can give attackers root access to Linux kernel

CSO Online · csoonline.com · 2026-05-01 01:14 UTC

‘Copy Fail’ bug can obtain root privileges in Linux distributions since 2017

SC Media · scworld.com · 2026-04-30 20:11 UTC

Linux 'Copy Fail' Flaw Delivers Root-Level Access to Distros

BankInfoSecurity · bankinfosecurity.com · 2026-04-30 15:18 UTC

New Linux ‘Copy Fail’ flaw gives hackers root on major distros

bleepingcomputer_all · bleepingcomputer.com · 2026-04-30 13:54 UTC

View all evidence

Overview

A critical local privilege escalation vulnerability, CVE-2026-31431, nicknamed 'Copy Fail,' has been disclosed affecting Linux kernels released since 2017.

Entities

Johannes Ullrich

Score total

1.97

Momentum 24h

Posts

Origins

Source types

Duplicate ratio

Why now

A public proof-of-concept exploit is available, increasing the risk of active exploitation.
No major Linux distributions have yet released patches, leaving systems vulnerable.
Security advisories urge immediate mitigation to protect exposed environments.

Why it matters

The vulnerability allows attackers to gain root access, risking full system compromise.
It affects virtually all Linux distributions with kernels since 2017, impacting a wide range of systems.
Critical infrastructure like Kubernetes nodes and CI/CD runners are especially at risk without immediate mitigation.

LLM analysis

Topic mix: lowPromo risk: lowSource quality: medium

Recurring claims

The 'Copy Fail' vulnerability (CVE-2026-31431) allows unprivileged local users to gain root access on Linux systems with kernels released since 2017.
A public proof-of-concept exploit is available, making the vulnerability trivial to exploit.
No major Linux distributions have yet released patches, though a mainline fix was committed on April 1, 2026.

How sources frame it