Proof-of-concept exploit available for Linux 'Copy Fail' vulnerability (CVE-2026-31431)

Proof-of-concept exploit available for Linux 'Copy Fail' (CVE-2026-31431) - feature image

Threat Research advisory Linux Copy Fail

On April 29, 2026, details about the ‘Copy Fail’ vulnerability (CVE-2026-31431) were publicly disclosed. This high-severity (CVSS score of 7.8) privilege escalation vulnerability impacts Linux distributions shipped since 2017. It allows an unprivileged local user to obtain root-level access on affected Linux systems by corrupting the kernel’s in-memory page cache of a privileged binary.

Public proof-of-concept (PoC) exploit code has been released, and reports indicate the exploit is reliable across multiple major Linux distributions. Given the breadth of affected systems and the trivially small exploit, organizations should prioritize patching, particularly for multi-tenant Linux hosts and container platforms.

Recommended actions

Counter Threat Unit™ (CTU) researchers recommend that organizations identify Linux systems running vulnerable kernel versions and apply appropriate vendor-issued kernel updates as soon as possible. In environments where immediate patching is not feasible, administrators should review temporary mitigations recommended by their Linux distribution vendors and minimize exposure to untrusted local code execution. In response to the disclosure, Linux distributions have released their own advisories:

Sophos protections

SophosLabs is monitoring this vulnerability and investigating detection and mitigation opportunities associated with exploitation activity. Sophos analysts are exploring threat hunting opportunities to identify potentially impacted customers and have evaluated if Sophos products are affected by this issue.

About the author

Sophos Counter Threat Unit Research Team

Sophos Counter Threat Unit™ (CTU) researchers are recognized authorities in the cybersecurity field, regularly contributing expert analysis to global media, publishing technical analyses for the security community, and presenting about emerging threats at leading security conferences. Backed by Sophos’ advanced security technologies and a broad network of intelligence contacts and partners, the CTU™ plays a critical role in identifying and tracking threat actors and analyzing anomalous activity, uncovering new attack techniques, threats, and major shifts in the threat landscape.