Threat reportVulnerabilityTL-2026-1831
CVE-2026-31431: Linux Local Privilege Escalation Actively Exploited by UMBRAL BISON Within 24 Hours of Disclosure
CVE-2026-31431 (TL-2026-1831), also tracked as Copy Fail, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-08-03. It is attributed to UMBRAL BISON (Belarus) with medium confidence, affects Linux Kernel (upstream) Linux Kernel crypto/algif_aead (AF_ALG, references 1 CVE (CVE-2026-31431), maps to 16 MITRE ATT&CK techniques (T1036, T1055.009, T1059.006), and is covered by 9 detection rules and 30 indicators of compromise.
- CVSS
- 7.8/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 16MITRE ATT&CK
- Actors
- 1UMBRAL BISON
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-1831
- Threat ID
- TL-2026-1831
- Also known as
- Copy Fail
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution
- UMBRAL BISON
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Belarus
- Motivation
- ESPIONAGE
- Target sectors
- government administration, military, defense, industrial, health, pharmaceuticals, logistics, cloud-hosting, technology
- Target regions
- ukraine, poland, lithuania, 151 - Eastern Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in CVE-2026-31431
Malware and tooling: Behavior:Linux/CVE-2026-31431, Exploit:Linux/CopyFailExpDl.A, Exploit:Python/CopyFail.A, PicassoLoader, Cobalt Strike, Metasploit CVE-2026-31431 local exploit module
How CVE-2026-31431 works
CVE-2026-31431 ("Copy Fail"), a CVSS 7.8 Linux kernel local privilege escalation flaw in the algif_aead AEAD crypto template, was publicly disclosed with a working PoC on 2026-04-29 and exploited in the wild within roughly 20-24 hours by the Belarus-nexus adversary UMBRAL BISON (aka UNC1151/Ghostwriter). CrowdStrike's 2026 Threat Hunting Report assessed 94% of first-24-hour activity as PoC-based testing behavior, consistent with the report's broader finding that 88% of exploitation involving public PoC occurs within 48 hours of disclosure.
CVE-2026-31431, nicknamed "Copy Fail" by researchers at Theori, is a logic flaw in the Linux kernel's cryptographic subsystem that was introduced by an in-place memory optimization merged in 2017 and only fully reverted in April 2026 (upstream commit a664bf3d603d, "crypto: algif_aead - Revert to operating out-of-place"). The kernel's algif_aead implementation reuses source memory as destination memory during AEAD cryptographic operations even though the source and destination come from different mappings. By chaining the AF_ALG socket interface with the splice() system call, an unprivileged local user can perform a controlled 4-byte write into the kernel page cache of any readable file — including setuid binaries such as /usr/bin/su — without ever writing to disk. Corrupting privilege-checking instructions inside a setuid binary's in-memory page allows the attacker to bypass access controls and spawn a root shell.
Unlike earlier Linux LPE bugs such as Dirty Cow and Dirty Pipe, Copy Fail does not require winning a race condition, making it deterministic and reliable across a very wide range of kernel builds. Virtually every mainstream Linux distribution shipping a kernel built between 2017 and the April 2026 patch is affected (Ubuntu, Debian, RHEL, SUSE/openSUSE, Fedora, Arch, Rocky Linux, AlmaLinux, Oracle Linux, Amazon Linux 2023, NixOS, Arista EOS), with NVD configuration data also flagging exposure in Siemens SIMATIC S7-1500 embedded Linux firmware. Because containers on a shared host frequently share a base-image kernel, the bug also enables container breakout and lateral movement across multi-tenant cloud and Kubernetes environments — CrowdStrike and Wiz both flagged the blast radius as touching a significant share of cloud Linux workloads and Kubernetes clusters.
Red Hat privately received the report on 2026-03-23; the upstream fix landed 2026-04-01; public disclosure with a working PoC and technical writeup followed on 2026-04-29, with a Metasploit module merged the same window (rapid7/metasploit-framework PR #21395) supporting AMD64 and AArch64 targets. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-05-01 with a federal remediation deadline of 2026-05-15. CrowdStrike OverWatch detected Belarus-nexus exploitation activity attributed to UMBRAL BISON "in just over 20 hours" after disclosure — the fastest adversary-attribution window discussed in the report — with roughly 94% of that first-day activity assessed as PoC-based testing rather than operational post-exploitation.
UMBRAL BISON (tracked elsewhere as UNC1151, FrostyNeighbor, UAC-0057, White Lynx, Storm-0257, TA445, and PUSHCHA, and publicly known as the Ghostwriter operation) is assessed by CrowdStrike as likely a Belarus-based, state-nexus adversary active since at least 2017 (previously the RepeatingUmbra cluster) that conducts intelligence-collection and enables information operations in support of Belarusian government interests, with a documented focus on Ukraine, Poland, and Lithuania. In related, previously reported Ghostwriter/UNC1151 activity (geofenced PDF-phishing campaigns against Ukrainian government/military and Polish industrial, healthcare, pharmaceutical, and logistics targets), the group used decoy documents impersonating Ukrtelecom, RAR archives containing JavaScript downloaders, and a PicassoLoader-to-Cobalt-Strike-Beacon delivery chain with server-side victim fingerprinting and manual operator validation before payload deployment. No malware, C2 infrastructure, or post-exploitation tooling specific to the UMBRAL BISON Copy Fail testing activity itself has been publicly disclosed by CrowdStrike; the actor's tradecraft documented here for the exploitation event is limited to rapid weaponization of the public PoC/Metasploit tooling.
Mitigation is available via kernel patch (all major vendors shipped fixed builds by early May 2026) or, where patching is not immediately possible, by blacklisting the algif_aead module (`install algif_aead /bin/false`), applying Red Hat's `initcall_blacklist` boot parameters, or blocking AF_ALG socket creation via seccomp in containerized environments.
MITRE ATT&CK techniques used in TL-2026-1831
Defense Evasion
T1036 Masquerading; T1055.009 Proc Memory; T1211 Exploitation for Stealth
Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1548.001 Setuid and Setgid
Discovery
T1082 System Information Discovery; T1613 Container and Resource Discovery
Command and Control
Initial Access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Resource Development
T1588.001 Malware; T1588.005 Exploits; T1588.006 Vulnerabilities
Reconnaissance
T1595.002 Vulnerability Scanning
privilege-escalation
Affected products and versions in CVE-2026-31431
- Linux Kernel (upstream) — Linux Kernel crypto/algif_aead (AF_ALG subsystem)
Vulnerable versions: 4.14-5.10.253; 5.11-5.15.203; 5.16-6.1.169; 6.2-6.6.136; 6.7-6.12.84; 6.13-6.18.21; 6.19-6.19.11; 7.0-rc1 through 7.0-rc6
Fixed in: kernel builds incorporating upstream commit a664bf3d603d - Canonical — Ubuntu Linux
Vulnerable versions: 16.04 Xenial (4.15); 18.04 Bionic (4.15, 5.4 HWE); 20.04 Focal (5.4, 5.15 HWE); 22.04 Jammy (5.15, 6.8 HWE); 24.04 Noble (6.8, 6.17 HWE); 25.10 Questing (6.17)
Fixed in: 4.15.0-251.263~16.04.1; 4.15.0-250.262 / 5.4.0-230.250~18.04.1; 5.4.0-230.250 / 5.15.0-179.189~20.04.1; 5.15.0-179.189 / 6.8.0-117.117~22.04.1; 6.8.0-117.117 / 6.17.0-29.29~24.04.1; 6.17.0-29-29 - Red Hat — Red Hat Enterprise Linux / OpenShift Container Platform
Vulnerable versions: RHEL 8; RHEL 9; RHEL 10; OpenShift Container Platform 4.12-4.21
Fixed in: RHSA-2026 series erratum; boot-parameter mitigation available via initcall_blacklist - Multiple — Debian, SUSE/openSUSE, Fedora, Arch Linux, Rocky Linux, AlmaLinux, Oracle Linux, Amazon Linux 2023, NixOS, Arista EOS
Vulnerable versions: kernels built from 2017 through April 2026, prior to distribution patch
Fixed in: distribution-specific patched kernel builds incorporating upstream commit a664bf3d603d - Siemens — SIMATIC S7-1500 (Linux-based embedded CPU firmware)
Vulnerable versions: firmware builds on affected kernel versions per NVD CPE configuration data
Fixed in: pending vendor advisory / firmware update
Remediation for CVE-2026-31431
Patches
- Upstream Linux kernel commit a664bf3d603d
- Canonical/Ubuntu per-release kernel updates (e.g. 6.8.0-117.117 Noble, 5.15.0-179.189 Jammy, 5.4.0-230.250 Focal, 4.15.0-250.262 Bionic, 4.15.0-251.263~16.04.1 Xenial, 6.17.0-29-29 Questing)
- Red Hat Security Advisories (RHSA-2026 series) for RHEL 8/9/10 and OpenShift Container Platform 4.12-4.21
Immediate actions
- Apply the vendor kernel patch incorporating upstream commit a664bf3d603d ('crypto: algif_aead - Revert to operating out-of-place')
- If a patch is unavailable, blacklist the vulnerable module: 'install algif_aead /bin/false' in /etc/modprobe.d/disable-algif.conf
- On Red Hat systems, apply boot-parameter mitigations: initcall_blacklist=algif_aead_init, initcall_blacklist=af_alg_init, initcall_blacklist=crypto_authenc_esn_module_init
- Block AF_ALG socket creation via seccomp policy in containerized and multi-tenant environments
Workarounds
- Disable/blacklist the algif_aead kernel module
- Restrict local and container shell access to trusted users only until patched
- Treat any container compromise on an unpatched host as a potential full host compromise
Longer-term hardening
- Prioritize patch rollout to Kubernetes nodes, CI/CD runners, and multi-tenant cloud hosts where container-breakout impact is highest
- Deploy EDR/behavioral detection for AF_ALG socket creation and for AF_ALG module loading delayed 300+ seconds after boot
- Monitor auth.log for malformed or missing invoking-username entries in su/sudo records as a post-exploitation indicator
- Track CISA KEV catalog status and internally enforce the federal remediation deadline (2026-05-15) as a patch SLA benchmark
CVEs associated with CVE-2026-31431
Weaknesses (CWE) in CVE-2026-31431
Timeline of CVE-2026-31431
- CVE-2026-31431 privately reported to Red Hat, beginning the coordinated disclosure window (RHSB-2026-002).
- Upstream Linux kernel fix committed (a664bf3d603d, 'crypto: algif_aead - Revert to operating out-of-place').
- CVE-2026-31431 published in the NVD with CVSS 3.1 base score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Public disclosure of the 'Copy Fail' vulnerability by Theori researchers with a working Python PoC exploit and technical writeup; a Metasploit exploit module was published in the same window.
- CrowdStrike OverWatch identified Belarus-nexus (UMBRAL BISON) exploitation activity against CVE-2026-31431 approximately 20 hours after public disclosure.
- Red Hat published RHSB-2026-002, CERT-EU issued advisory 2026-005, and Canonical/Ubuntu published per-release kernel fixes; CrowdStrike OverWatch detected widespread PoC-based testing activity.
- Microsoft published exploitation analysis and Defender detection guidance for CVE-2026-31431, noting preliminary in-the-wild testing activity likely to increase.
- CISA added CVE-2026-31431 to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of 2026-05-15.
- CrowdStrike's 2026 Threat Hunting Report formally documented the UMBRAL BISON exploitation timeline, assessing ~94% of first-24-hour activity as PoC-based testing behavior.
Sources cited for CVE-2026-31431
- CrowdStrike 2026 Threat Hunting Report: Exploitation Window Closes as AI Use Accelerates
- Umbral Bison Adversary Profile
- CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments
- Copy Fail: Universal Linux Local Privilege Escalation Vulnerability
- NVD - CVE-2026-31431
- RHSB-2026-002 Cryptographic Subsystem Privilege Escalation - Linux Kernel (CVE-2026-31431) - Copy Fail
- Nine-year-old Linux kernel flaw enables reliable local privilege escalation (CVE-2026-31431)
- Fixes available for CVE-2026-31431 (Copy Fail) Linux Kernel Local Privilege Escalation Vulnerability
- CERT-EU - High Vulnerability in the Linux Kernel ("Copy Fail")
- Theori copy-fail-CVE-2026-31431 PoC exploit
- Add exploit for CVE-2026-31431 (Copy Fail)
- Ghostwriter Targets Ukrainian Government With Geofenced PDF Phishing, Cobalt Strike
Detection coverage for TL-2026-1831
As of 2026-08-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1831 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.