U.S. CISA adds a flaw in Linux Kernel to its Known Exploited Vulnerabilities catalog
U.S. CISA adds a flaw in Linux Kernel to its Known Exploited Vulnerabilities catalog
Publish Date: 2026-05-04 06:29:00
Source Domain: securityaffairs.com
U.S. CISA adds a flaw in Linux Kernel to its Known Exploited Vulnerabilities catalog
Pierluigi Paganini
May 04, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in Linux Kernel to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a flaw in the Linux Kernel, tracked as CVE-2026-31431 (CVSS score of 7.8), to its Known Exploited Vulnerabilities (KEV) catalog.
Recently, Xint Code researchers warned of a serious Linux flaw, tracked as CVE-2026-31431, dubbed Copy Fail. It lets any local, unprivileged user write four controlled bytes into the page cache of any readable file, enabling escalation to root on major distributions.
The bug combines AF_ALG and splice() to write 4 bytes into the page cache of any readable file. A 732-byte script can modify a setuid binary in memory, without changing the file on disk, making detection difficult. The issue affects major distributions like Ubuntu, RHEL, SUSE, and Amazon Linux, and can even cross container boundaries due to shared page cache.
“Copy Fail (CVE-2026-31431) is a logic bug in the Linux kernel’s authencesn cryptographic template. It lets an unprivileged local user trigger a deterministic, controlled 4-byte write into the page cache of any readable file on the system.” reads the report published by Xint Code. “A single 732-byte Python script can edit a setuid binary and obtain root on essentially all Linux distributions shipped since 2017.“
Copy Fail exploits a kernel logic flaw where corrupted page‑cache data is never marked dirty, leaving disk files unchanged while the in‑memory version is silently altered. Because the page cache is what processes read, an unprivileged user can corrupt a setuid binary’s cached page and gain root. The shared cache also lets the attack cross container boundaries. The bug, surfaced…
