---
title: "US warns CopyFail Linux bug is being exploited"
description: "CopyFail (CVE-2026-31431) lets a limited user gain root on most Linux distributions, and CISA says attackers are already using it."
url: https://kurddevelopers.com/en/news/copyfail-linux-bug-cisa-warning
language: en # English
type: news
published: 2026-05-04T20:50:00.000Z
updated: 2026-11-02T04:14:03.000Z
author: "Osamah Ismail"
author_url: https://kurddevelopers.com/en/author/1
section: "Security"
tags: ["Linux","CopyFail","CVE-2026-31431","CISA","Security"]
sources: ["TechCrunch","CISA","Microsoft Security Blog"]
image: https://kurddevelopers.com/uploads/2026/11/lukas-nlsxfjl-nhc-unsplash-28473bb6.jpg
translations:
  ku: https://kurddevelopers.com/news/copyfail-linux-bug-cisa-warning
  ar: https://kurddevelopers.com/ar/news/copyfail-linux-bug-cisa-warning
publisher: Kurd Developers
publisher_url: https://kurddevelopers.com/
---

# US warns CopyFail Linux bug is being exploited

> CopyFail (CVE-2026-31431) lets a limited user gain root on most Linux distributions, and CISA says attackers are already using it.

![Image: Lukas / Unsplash](https://kurddevelopers.com/uploads/2026/11/lukas-nlsxfjl-nhc-unsplash-28473bb6.jpg)

## The bug
**CopyFail**, tracked as **CVE-2026-31431**, affects **Linux kernel 7.0** and earlier. It lets a user with limited privileges gain **full administrator (root) access**.

## How serious is it?
- **CISA** says it is being exploited in the wild and ordered federal civilian agencies to patch by **May 15**.
- Per Microsoft, it can't be exploited over the internet alone, but it can be chained with a bug that can.

## Who found it
Security firm **Theori** found it and verified it on:
- Red Hat Enterprise Linux 10.1
- Ubuntu 24.04 LTS
- Amazon Linux 2023
- SUSE 16

It was disclosed in late March and the kernel was patched about a week later.

## What to do
If you run Linux servers or PCs, install **kernel updates** promptly.

**Sources:** TechCrunch, CISA, Microsoft Security Blog

---

Published by [Kurd Developers](https://kurddevelopers.com/) on 2026-05-04. Cite as: “US warns CopyFail Linux bug is being exploited”, Kurd Developers, https://kurddevelopers.com/en/news/copyfail-linux-bug-cisa-warning