Linux kernel vulnerability CopyFail under active exploitation

A severe security vulnerability, dubbed “CopyFail,” affects almost every version of the Linux operating system and is currently being exploited in the wild, according to the U.S. government. The vulnerability, officially tracked as CVE-2026-31431, was discovered in Linux kernel versions 7.0 and earlier. The flaw was disclosed to the Linux kernel security team in late March and patched after about a week. However, because the patches have not yet fully trickled down to the many Linux distributions that rely on the vulnerable kernel, numerous systems remain at risk of compromise.

The bug is named CopyFail because an affected component in the Linux kernel—the core of the operating system—fails to copy certain data when it should. This failure corrupts sensitive data within the kernel, allowing an attacker to leverage the kernel’s deep access to the rest of the system and its data.

The CopyFail bug cannot be exploited over the internet on its own. However, Microsoft reported that if chained with another vulnerability, an attacker could use the flaw to gain root access—meaning full administrative control—to an affected server. A user operating a Linux computer with a vulnerable kernel could also be tricked into opening a malicious link or attachment that triggers the vulnerability. According to the CopyFail website, the exploit can gain root access on every Linux distribution shipped since 2017. Jorijn Schrijvershof, a DevOps engineer and developer who analyzed the exploit, described the bug as having an “unusually big blast radius” that affects “nearly every modern distribution” of the operating system.

The security firm Theori, which discovered the CopyFail vulnerability, verified the flaw in several widely used versions of Linux. These affected distributions include:

• Red Hat Enterprise Linux 10.1
• Ubuntu 24.04
• SUSE 16

Because the Linux kernel underpins much of the infrastructure used in enterprise settings, the potential impact of the vulnerability is widespread. In response to the active exploitation of the bug, the Cybersecurity and Infrastructure Security Agency (CISA)—the U.S. cybersecurity agency—has issued an order for civilian federal agencies to patch affected systems. CISA has set a deadline of May 15 for these agencies to apply the necessary updates to mitigate the risk of unauthorized access or potential supply chain attacks, which compromise software by attacking the development process.

Why it matters

The vulnerability poses a significant risk to enterprise data centers, as the Linux kernel underpins much of the world’s critical infrastructure and cloud services.