US warns CopyFail Linux bug is being exploited
CopyFail (CVE-2026-31431) lets a limited user gain root on most Linux distributions, and CISA says attackers are already using it.
The bug
CopyFail, tracked as CVE-2026-31431, affects Linux kernel 7.0 and earlier. It lets a user with limited privileges gain full administrator (root) access.
How serious is it?
- CISA says it is being exploited in the wild and ordered federal civilian agencies to patch by May 15.
- Per Microsoft, it can't be exploited over the internet alone, but it can be chained with a bug that can.
Who found it
Security firm Theori found it and verified it on:
- Red Hat Enterprise Linux 10.1
- Ubuntu 24.04 LTS
- Amazon Linux 2023
- SUSE 16
It was disclosed in late March and the kernel was patched about a week later.
What to do
If you run Linux servers or PCs, install kernel updates promptly.
Founder and editor-in-chief of Kurd Developers. Phone and tech news on YouTube, Instagram and TikTok.
More stories
One text can break your phone: Android's 'SMS of Death' explained
A flaw in Android 12 and later lets a specially crafted SMS drop calls and even make a phone unusable. The fix is in October's security patch.
GTA VI lands November 19: prices, editions and what to know
Rockstar has locked the date: Thursday, November 19 on PS5 and Xbox Series X|S. Standard costs $79.99 and Ultimate $99.99.
Apple's first touchscreen MacBook Pro brings OLED and Dynamic Island
The new PROLED XDR display responds to touch, the notch is gone and Dynamic Island takes its place. Prices start at $2,899.
The $1,999 iPhone Duo Has a Black-Bar Problem, and Fixing It Is Harder Than It Looks
Apple's first foldable is a hardware flex. But unfold it and many of your apps shrink into a phone-shaped window floating in black. Here's why the app world wasn't ready, and why developers can't just hit "stretch".