Trending
CVE-2026-31431

CVE detail

CVE-2026-31431

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

CVSS 7.8 · HighBuzz score 93.0KEV listed6 public exploit repository references

Buzz score

Why this CVE is surfacing

Buzz score total 93.0

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 30.0 · diversity 20.0 · KEV 25.0 · OTX 0.0 · PoC 18.0

Mention score

30.0

145 evidence mentions in the snapshot

Diversity score

20.0

20 sources across 7 categories

KEV score

25.0

Known exploited vulnerability present

OTX score

0.0

0 OTX pulses

PoC score

18.0

6 repos · best confidence 0.99

Best PoC traction

437

Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions: 2; within the 30d window
Peak daily: 1; highest bucket

Evidence

Source links by recency

Newest mentions first

145 source links · newest first

ABB Ability EdgeniusCISA Alerts
View CSAF Summary ABB is aware of public reports of a vulnerability CVE‑2026‑31431 (Copy Fail) in the product versions listed as affected in the advisory. An update is available that resolves a publicly reported vulnerability. CVE‑2026‑31431 (Copy Fail) is a Linux kernel vulnerability that may allow a locally authenticated user or compromised container workload to gain elevated (root) privileges on affected systems. Once root access is obtained, the attacker can effectively gain complete control
governmentwww.cisa.govJul 14, 2026, 12:00 PM
16-year-old KVM flaw allows attackers to escape VMs and take over Linux serversCSO Online
y that cloud providers and enterprises rely on to isolate sensitive processes on servers. The vulnerability, tracked as CVE-2026-53359 , stems from a use-after-free memory bug in the shadow MMU emulation of KVM on x86 CPU architecture. According to Hyunwoo Kim , the researcher who discovered it, the flaw has been present in the Linux kernel code for th
newswww.csoonline.comJul 7, 2026, 9:53 PM
DirtyClone: Fourth Linux Kernel Flaw in Six Weeks Escalates to RootSecurity Affairs
DirtyClone: a Linux kernel privilege escalation that silently rewrites executables in memory, leaving no disk trace. Patch now. JFrog Security Research published a working exploit walkthrough on June 25 for CVE-2026-43503 (CVSS score of 8.8), a Linux kernel privilege escalation they call DirtyClone. It’s the fourth vulnerability in the DirtyFrag family, all sharing the same […]
newssecurityaffairs.comJun 27, 2026, 9:12 AM
Impact of Linux Kernel vulnerabilities on B&R productsCISA Alerts
CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RC:C CVE-2026-43284 In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_
governmentwww.cisa.govJun 23, 2026, 12:00 PM
DirtyDecrypt: PoC Released for yet another Linux flawSecurity Affairs
DirtyDecrypt (CVE-2026-31635): working PoC out for a Linux kernel LPE flaw. Missing COW guard in rxgk_decrypt_skb lets local attackers reach root. After Copy Fail, Dirty Frag, and Fragnesia, here comes DirtyDecrypt, another local privilege escalation vulnerability in the kernel, this time with a working proof-of-concept already out in the open. The flaw was discovered and […]
newssecurityaffairs.comMay 20, 2026, 7:36 AM
Linux kernel maintainers suggest a ‘kill switch’ to protect systems until a zero-day vulnerability is patchedCSO Online
Linux server admins may get the ability to turn off a vulnerable function in the OS kernel until a patch for a zero-day vulnerability is ready, if a proposal from a kernel developer and maintainer is accepted by the open source community. The idea of a kill switch for privileged operators has been suggested by […]
newswww.csoonline.comMay 12, 2026, 12:47 AM
Linux developers weigh emergency “killswitch” for vulnerable kernel functionsHelp Net Security
Linux kernel developers are reviewing a proposal for an emergency risk mitigation mechanism (“Killswitch”) that would allow administrators to disable vulnerable kernel functions at runtime. The proposal, submitted by Linux kernel developer/maintainer Sasha Levin, arrives in the wake of the public disclosure of two privilege escalation vulnerabilities affecting the Linux kernel. What prompted the proposal The impetus for the proposal is explicit: the patch’s selftest references Copy Fail (CVE-2026-31431), a nine-year-old local privilege escalation flaw … More →
newswww.helpnetsecurity.comMay 11, 2026, 12:55 PM
New ‘Dirty Frag’ exploit targets Linux kernel for root accessCSO Online
A newly disclosed Linux privilege escalation issue dubbed “Dirty Frag” is giving attackers a cleaner path to post-compromise escalation to root privileges. According to Microsoft, a couple of vulnerabilities constituting the issue, affecting Linux kernel networking and memory-fragment handling components, are already seeing active exploitation in the wild. The exploitation attempts look indistinguishable from the […]
newswww.csoonline.comMay 11, 2026, 12:01 PM
Dirty Frag: Unpatched Linux vulnerability delivers root accessHelp Net Security
A week after Copy Fail, another Linux local privilege escalation vulnerability dubbed “Dirty Frag” has been revealed, along with a PoC exploit. What is Dirty Frag In effect, Dirty Frag refers to two flaws: A xfrm-ESP Page-Cache Write vulnerability (CVE-2026-43284, aka Copy Fail 2.0), now patched in the Linux kernel, affects the modules supporting one of the protocols used for IPsec A RxRPC Page-Cache Write vulnerability (CVE number reserved: CVE-2026-43500), currently unpatched, affects the modules … More →
newswww.helpnetsecurity.comMay 8, 2026, 2:13 PM
May 2026 Patch Tuesday forecast: AI starts driving security industry changesHelp Net Security
Microsoft May 2026 Patch Tuesday is now live: Many fixes, but no zero-days Project Glasswing. This is one of three major security industry changes I’ll cover today. The Anthropic Mythos vulnerability discovery model has already proven to be game changing in its ability to identify new vulnerabilities in software. Many of these vulnerabilities have existed for 10 to 15 years without human discovery. In a recent announcement from Mozilla, they discovered 271 vulnerabilities when running … More →
newswww.helpnetsecurity.comMay 8, 2026, 6:19 AM
Copy Fail: What You Need to Know About the Most Severe Linux Threat in YearsUnit42
Copy Fail (CVE-2026-31431) is a critical Linux kernel LPE that allows stealthy root access. This flaw impacts millions of systems. Read our analysis.
vendorunit42.paloaltonetworks.comMay 5, 2026, 11:00 PM
Exploitation of ‘Copy Fail’ Linux Vulnerability BeginsSecurityWeek
CISA has added the bug to its KEV list, and Microsoft has observed limited exploitation, mainly associated with PoC testing.
newswww.securityweek.comMay 4, 2026, 10:42 AM
U.S. CISA adds a flaw in Linux Kernel to its Known Exploited Vulnerabilities catalogSecurity Affairs
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in Linux Kernel to its Known Exploited Vulnerabilities catalog The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a flaw in the Linux Kernel, tracked as CVE-2026-31431 (CVSS score of 7.8), to its Known Exploited Vulnerabilities (KEV) catalog. Recently, Xint Code researchers warned of a serious Linux […]
newssecurityaffairs.comMay 4, 2026, 10:26 AM
CVE-2026-31431 crypto: algif_aead - Revert to operating out-of-placeMicrosoft MSRC
Information published.
vendormsrc.microsoft.comMay 3, 2026, 8:01 AM
Week in review: High-severity LPE vulnerability in the Linux kernel, cPanel 0-day exploited for monthsHelp Net Security
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: The AI criminal mastermind is already hiring on gig platforms Labor-hire platforms let anyone with a credit card post a task and pay a stranger to complete it. The RentAHuman platform extends that model to AI agents through a Model Context Protocol server, allowing an agent to post gigs directly. Listed tasks include attending in-person meetings, photographing locations, delivering items, … More →
newswww.helpnetsecurity.comMay 3, 2026, 8:00 AM
‘Trivial’ exploit can give attackers root access to Linux kernelCSO Online
CSOs must ensure their Linux-based systems block unauthorized privilege escalation until distros release patches to plug a serious kernel vulnerability affecting all Linux distributions shipped since 2017. Until fixes are available for what’s been dubbed the Copy Fail logic bug (CVE-2026-31431), which lets users easily obtain root access, there isn’t much CSOs can do, says […]
newswww.csoonline.comMay 1, 2026, 1:14 AM
Copy Fail: New Linux bug enables Root via page‑cache corruptionSecurity Affairs
Linux flaw CVE‑2026‑31431, ‘Copy Fail,’ lets any local user write four bytes into page cache files, enabling easy escalation to root on major distros. Xint Code researchers warn of a serious Linux flaw, tracked as CVE-2026-31431 (CVSS score of 7.8), dubbed Copy Fail. It lets any local, unprivileged user write four controlled bytes into the […]
newssecurityaffairs.comApr 30, 2026, 6:23 PM
Nine-year-old Linux kernel flaw enables reliable local privilege escalation (CVE-2026-31431)Help Net Security
Security researchers at Theori have disclosed a high-severity local privilege escalation (LPE) vulnerability (CVE-2026-31431) in the Linux kernel. The flaw, nicknamed “Copy Fail”, has affected virtually every major Linux distribution shipped since 2017, and a working proof-of-concept (PoC) exploit is publicly available. About CVE-2026-31431 According to Theori researchers, CVE-2026-31431 originates from the interaction of three reasonable kernel changes made over several years: the addition of authencesn (an AEAD cryptographic wrapper used by IPsec) in 2011, … More →
newswww.helpnetsecurity.comApr 30, 2026, 11:41 AM
‘Copy Fail’ Logic Flaw in Linux Kernel Enables System TakeoverSecurityWeek
Affecting the kernel’s authencesn cryptographic template, the vulnerability was introduced in 2017 and impacts all distributions.
newswww.securityweek.comApr 30, 2026, 10:06 AM
https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlcert-portal.siemens.com
No excerpt available.
Vendor Advisorycert-portal.siemens.comApr 22, 2026, 9:16 AM
https://xint.io/blog/copy-fail-linux-distributions#the-fix-6xint.io
No excerpt available.
Exploitxint.ioApr 22, 2026, 9:16 AM
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-31431www.cisa.gov
No excerpt available.
Mitigationwww.cisa.govApr 22, 2026, 9:16 AM
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31431.jsonsecurity.access.redhat.com
No excerpt available.
Vendor Advisorysecurity.access.redhat.comApr 22, 2026, 9:16 AM
https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/lore.kernel.org
No excerpt available.
Vendor Advisorylore.kernel.orgApr 22, 2026, 9:16 AM
https://github.com/theori-io/copy-fail-CVE-2026-31431github.com
No excerpt available.
Exploitgithub.comApr 22, 2026, 9:16 AM
https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlcert-portal.siemens.com
No excerpt available.
Vendor Advisorycert-portal.siemens.comApr 22, 2026, 9:16 AM
https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlcert-portal.siemens.com
No excerpt available.
Vendor Advisorycert-portal.siemens.comApr 22, 2026, 9:16 AM
https://bugzilla.redhat.com/show_bug.cgi?id=2460538bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/security/cve/cve-2026-31431#cve-details-mitigationaccess.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/security/cve/CVE-2026-31431access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:33486access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:19225access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:19074access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:16210access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:16209access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:16208access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:16111access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:16063access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:16018access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:15978access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:15976access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:15087access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:14926access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:14773access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:14339access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:14301access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:14230access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:14165access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:14137access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:14112access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:14097access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:13936access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:13932access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:13887access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:13885access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:13862access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:13811access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:13734access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:13729access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:13727access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:13690access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:13681access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:13578access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:13577access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:13566access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://access.redhat.com/errata/RHSA-2026:13565access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 22, 2026, 9:16 AM
https://www.kb.cert.org/vuls/id/260001www.kb.cert.org
No excerpt available.
Patchwww.kb.cert.orgApr 22, 2026, 9:16 AM
https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170websec.net
No excerpt available.
Exploitwebsec.netApr 22, 2026, 9:16 AM
https://copy.failcopy.fail
No excerpt available.
Exploitcopy.failApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/18/3www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/08/13www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/07/2www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/07/12www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/06/5www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/04/9www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/04/8www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/04/31www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/04/29www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/04/28www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/04/27www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/04/24www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/04/2www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/04/14www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/04/13www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/04/12www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/04/11www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/04/10www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/04/1www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/03/6www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/03/5www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/03/4www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/03/3www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/03/13www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/03/12www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/03/10www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/02/8www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/02/7www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/02/6www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/02/5www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/02/4www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/02/25www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/02/24www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/02/23www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/02/21www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/02/20www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/02/19www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/02/18www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/02/17www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/02/16www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/02/15www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/02/14www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/01/3www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/01/24www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/01/23www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/01/22www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/01/2www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/01/18www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/01/17www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/01/16www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/01/15www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/01/12www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/05/01/10www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/04/30/6www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/04/30/5www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/04/30/20www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/04/30/2www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/04/30/18www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/04/30/17www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/04/30/16www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/04/30/15www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/04/30/14www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/04/30/12www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/04/30/11www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/04/30/10www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/04/29/26www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/04/29/25www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
http://www.openwall.com/lists/oss-security/2026/04/29/23www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 22, 2026, 9:16 AM
https://git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8git.kernel.org
No excerpt available.
Patchgit.kernel.orgApr 22, 2026, 9:16 AM
https://git.kernel.org/stable/c/ce42ee423e58dffa5ec03524054c9d8bfd4f6237git.kernel.org
No excerpt available.
Patchgit.kernel.orgApr 22, 2026, 9:16 AM
https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5git.kernel.org
No excerpt available.
Patchgit.kernel.orgApr 22, 2026, 9:16 AM
https://git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875bgit.kernel.org
No excerpt available.
Patchgit.kernel.orgApr 22, 2026, 9:16 AM
https://git.kernel.org/stable/c/8b88d99341f139e23bdeb1027a2a3ae10d341d82git.kernel.org
No excerpt available.
Patchgit.kernel.orgApr 22, 2026, 9:16 AM
https://git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667git.kernel.org
No excerpt available.
Patchgit.kernel.orgApr 22, 2026, 9:16 AM
https://git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fcgit.kernel.org
No excerpt available.
Patchgit.kernel.orgApr 22, 2026, 9:16 AM
https://git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130cgit.kernel.org
No excerpt available.
Patchgit.kernel.orgApr 22, 2026, 9:16 AM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

6 repository references · best confidence 0.99 · max 437 stars

tgies/copy-fail-cHigh confidence
githubRepository topic discovery437 starsDiscovered Jul 17, 2026, 12:51 PM
Dullpurple-sloop726/CVE-2026-31431-Linux-Copy-FailHigh confidence
githubDiscovery source unavailable3 starsDiscovered Jul 9, 2026, 1:19 AM
krisiasty/vcheckMedium confidence
githubRepository topic discovery2 starsDiscovered Jul 13, 2026, 10:51 AM
toxy4ny/COPY-FAILHigh confidence
gitlabRepository topic discovery1 starsDiscovered Jul 11, 2026, 8:51 PM
Liverwortenuresis371/copyfail-rsHigh confidence
githubDiscovery source unavailable1 starsDiscovered Jul 9, 2026, 1:19 AM
theori-io/copy-fail-CVE-2026-31431High confidence
githubNVD Exploit reference0 starsDiscovered Jul 11, 2026, 12:20 PM
NVD labels the source link as Exploit; this is not independent verification of the repository's code.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence

CVE-2022-27239
In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges.
CVSS 7.8 · High
CVE-2017-18017
The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-…
CVSS 9.8 · Critical
CVE-2021-4034
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as pr…
CVSS 7.8 · High
KEV listedPublic PoC observed24 mentions
CVE-2020-14355
Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk)…
CVSS 6.6 · Medium
CVE-2019-9506
The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length…
CVSS 8.1 · High
7 mentions
CVE-2019-10126
A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corrupt…
CVSS 9.8 · Critical

External lookup

Potential internet exposure

Potential exposure only — not proof of vulnerability.Shodan results indicate potentially internet-exposed products, not confirmed vulnerable systems. They do not confirm that any returned system is vulnerable to CVE-2026-31431.

Product-level CPE searches intentionally omit version fields and NVD version-range or configuration certainty. Verify the exact product version and configuration independently.

Sign-in required. Shodan requires you to sign in to run these filter searches.

Product CPE queries

Derived from this CVE's existing NVD CPE 2.3 records; the application, operating-system, or hardware part is retained.

cpe:2.3:o:amazon:amazon_linuxSearch this product on Shodan
cpe:2.3:o:canonical:ubuntu_linuxSearch this product on Shodan
cpe:2.3:o:debian:debian_linuxSearch this product on Shodan
cpe:2.3:o:linux:linux_kernelSearch this product on Shodan
cpe:2.3:o:opensuse:leapSearch this product on Shodan
cpe:2.3:o:redhat:enterprise_linuxSearch this product on Shodan
cpe:2.3:o:redhat:enterprise_linux_ausSearch this product on Shodan
cpe:2.3:o:redhat:enterprise_linux_eusSearch this product on Shodan
cpe:2.3:o:redhat:enterprise_linux_tusSearch this product on Shodan
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutionsSearch this product on Shodan
cpe:2.3:a:redhat:openshift_container_platformSearch this product on Shodan
cpe:2.3:o:suse:basesystem_moduleSearch this product on Shodan
cpe:2.3:a:suse:caas_platformSearch this product on Shodan
cpe:2.3:o:suse:development_tools_moduleSearch this product on Shodan
cpe:2.3:a:suse:enterprise_storageSearch this product on Shodan
cpe:2.3:o:suse:legacy_moduleSearch this product on Shodan
cpe:2.3:o:suse:linux_enterprise_desktopSearch this product on Shodan
cpe:2.3:o:suse:linux_enterprise_high_availability_extensionSearch this product on Shodan
cpe:2.3:o:suse:linux_enterprise_high_performance_computingSearch this product on Shodan
cpe:2.3:o:suse:linux_enterprise_live_patchingSearch this product on Shodan
cpe:2.3:a:suse:manager_proxySearch this product on Shodan
cpe:2.3:a:suse:manager_retail_branch_serverSearch this product on Shodan
cpe:2.3:a:suse:manager_serverSearch this product on Shodan
cpe:2.3:a:suse:openstack_cloudSearch this product on Shodan
cpe:2.3:a:suse:openstack_cloud_crowbarSearch this product on Shodan

Exact CVE query

Eligible paid Shodan plan required

Shodan's exact vuln: filter is separate from the product searches above and requires an eligible paid Shodan plan.

vuln:CVE-2026-31431Search this CVE on Shodan

These are outbound search links only. cvebuzz makes no Shodan API call, uses no Shodan API key, and does not display live result counts.

Metadata

Canonical fields

NVD status

Analyzed

Published

Apr 22, 2026

Modified

Jul 15, 2026

Official record

Authoritative NVD record

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE IDs

Vendor classifications

How this vector reads

CVSS 3.1 base metrics decoded below. This explanation does not recalculate or change the NVD score.

Attack Vector (AV): Local. The attacker needs local access to the vulnerable system.
Attack Complexity (AC): Low. No special conditions beyond the attacker-controlled steps are required.
Privileges Required (PR): Low. The attacker needs basic user-level privileges.
User Interaction (UI): None. Exploitation does not require another user to act.
Scope (S): Unchanged. Impacts remain within the vulnerable security authority.
Confidentiality Impact (C): High. There is a total or serious impact to this security property.
Integrity Impact (I): High. There is a total or serious impact to this security property.
Availability Impact (A): High. There is a total or serious impact to this security property.

Signals

Exploitation indicators

1 stored signals · KEV present · 0 OTX pulses

KEVKEV
- cwes: CWE-669
- dueDate: 2026-05-15
- knownRansomwareCampaignUse: Unknown
- notes: https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/; https://xint.io/blog/copy-fail-linux-distributions#the-fix-6 ; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/about/ ; https://nvd.nist.gov/vuln/detail/CVE-2026-31431
- product: Kernel
- requiredAction: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- shortDescription: Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.
- vendorProject: Linux
- vulnerabilityName: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
Observed May 1, 2026, 12:00 AM