What is CVE-2026-31431?
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place. This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
The record classifies CVE-2026-31431 under weakness class CWE-669. Its CVSS v3 base vector states that the flaw requires local access to the host, needs low-privilege credentials, needs no user interaction, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 189 days ago.
Severity and exploitation probability
- CVSS v3.1 base score
- 7.8 — HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS (FIRST)
- 3.4% probability of exploitation in the next 30 days, higher than 88.6% of all scored CVEs
- CISA KEV
- Listed since 2026-05-01, federal remediation deadline 2026-05-15
- Threadlinqs priority
- 9/10 — CISA KEV-listed, which Threadlinqs floors at 9
- Published
- 2026-04-22, last modified 2026-09-08
Is CVE-2026-31431 being exploited?
CISA added CVE-2026-31431 to the Known Exploited Vulnerabilities catalog on 2026-05-01, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2026-05-15 under BOD 22-01. Weaponised exploit code for CVE-2026-31431 is publicly available. 11 public proof-of-concept repositories are tracked for this identifier. It currently carries a trending score of 45 in the Threadlinqs vulnerability feed.
- theori-io/copy-fail-CVE-2026-31431 (github)
- tgies/copy-fail-c (github)
- badsectorlabs/copyfail-go (github)
- Percivalll/Copy-Fail-CVE-2026-31431-Kubernetes-PoC (github)
- Sndav/CVE-2026-31431-Advanced-Exploit (github)
- painoob/Copy-Fail-Exploit-CVE-2026-31431 (github)
- sgkdev/page_inject (github)
- Crihexe/copy-fail-tiny-elf-CVE-2026-31431 (github)
Affected products and versions
- Linux: Kernel
How to fix CVE-2026-31431
The record marks a vendor fix as available for CVE-2026-31431. Vendor advisory: https://git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8. Because CVE-2026-31431 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2026-05-15. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.
Threat activity tracking CVE-2026-31431
6 tracked threats in the Threadlinqs corpus reference CVE-2026-31431, either in the campaign’s CVE list or as an indicator on the campaign record.
- Q2 2026 Vulnerability and Exploit Landscape: Exploited AI-platform flaws (OpenClaw CVE-2026-25253, Dify CVE-2026-41948, Open WebUI CVE-2026-45386), Exchange CVE-2026-45501, and Linux kernel page-cache LPE exploit wave (Copy Fail, Dirty Frag) — HIGH · 2026-10-20
- Eclypsium InfraTrust Report: Mass Active Exploitation of Network Management Systems (Cisco FMC/ISE CVE-2026-20079, CVE-2026-76460; SonicWall SMA 1000 CVE-2026-83548/83549; Linux Kernel CopyFail CVE-2026-31431) — CRITICAL · 2026-09-23
- CVE-2026-31431: Linux Local Privilege Escalation Actively Exploited by UMBRAL BISON Within 24 Hours of Disclosure — HIGH · 2026-08-03
- Linux Kernel LPE Surge: Copy Fail (CVE-2026-31431), Dirty Frag/Fragnesia (CVE-2026-43284/CVE-2026-43500/CVE-2026-46300), and CrackArmor AppArmor Flaws vs. Defense-in-Depth Mitigations — HIGH · 2026-05-29
- CVE-2026-31431 "Copy Fail" — Linux Kernel algif_aead Deterministic Local Privilege Escalation Affecting All Major Distributions — HIGH · 2026-05-08
- Linux Kernel 'Copy Fail' Local Privilege Escalation (CVE-2026-31431) — algif_aead 4-Byte Page Cache Write to setuid Root — HIGH · 2026-04-30
Sources
Enriched from CVE.org, FIRST EPSS, CISA KEV, public proof-of-concept repositories. Last verified by Threadlinqs on .
Other references
- git.kernel.org
- git.kernel.org (19d43105a97be0810edbda875f2cd03f30dc130c)
- git.kernel.org (961cfa271a918ad4ae452420e7c303149002875b)
- git.kernel.org (3115af9644c342b356f3f07a4dd1c8905cd9a6fc)
- git.kernel.org (8b88d99341f139e23bdeb1027a2a3ae10d341d82)
Showing 5 of 13 recorded references.