CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV

Summary: CISA added CVE-2026-31431, a local privilege escalation flaw in the Linux kernel with a CVSS score of 7.8, to its Known Exploited Vulnerabilities catalog on Friday, citing evidence of active exploitation. The nine-year-old bug, tracked as Copy Fail by Theori and Xint, stems from a logic bug in the kernel's authentication cryptographic template that lets an unprivileged local user gain root via a 732-byte Python exploit, and fixes are available in Linux kernel versions 6.18.22, 6.19.12, and 7.0.
Bottom line: The exploit uses only legitimate system calls and needs no race conditions or memory address guessing, so detection is difficult and the barrier to entry is low - and Kaspersky notes Docker, LXC, and Kubernetes grant container processes access to the AF_ALG subsystem by default, putting container isolation and the underlying host at risk. FCEB agencies have been advised to apply fixes by May 15, 2026.

Read the original at The Hacker News ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2026-31431
Related: Dirty Decrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability Cyber Risks ·
15-Year-Old Ghost Lock Flaw Enables Root and Container Escape on Most Linux Distros Cyber Risks ·
CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability Known Exploited Vulnerabilities · May 01, 2026