CVE-2026-31431Vulnerability

Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on 1 May 2026.

Reported by 6 independent sources · first reported 9 May 2026 by Elastic Security Labs · last reported 22 Sep 2026

Last reported 1 month ago

CISA KEVAdded 1 May 2026
Fix due 15 May 2026
Used by ransomware: not knownCISA KEV catalogue

EPSS3.4%
higher than 88% of CVEsFIRST EPSS, as of 23 Oct 2026

What the reports say

8 reports, newest first · the exact sentence from each

“SIMATIC AX Runtime Core Linux Common Debian vers:all/* (CVE-2026-31431)”

CISA advisoriesGovernment22 Sep 2026
Siemens SIPLUS and SIMATIC Products
“Ability Edgenius >=3.2.0.0|<3.2.4.1, 3.2.4.1 (CVE-2026-31431)”

CISA advisoriesGovernment17 Sep 2026
ABB Ability Edgenius
“Copy Fail: CVE-2026-31431 · AF_ALG AEAD page-cache corruption”

Elastic Security LabsVendor11 Sep 2026
Linux Detection Engineering - Local Privilege Escalation
“CVE-2026-31431 (Copy Fail): a local privilege escalation vulnerability in the Linux kernel that lets an unprivileged user modify the page cache and gain root privileges.”

Kaspersky SecurelistVendor26 Aug 2026
Exploits and vulnerabilities in Q2 2026
“From Exploit Code to Production Detection: Building a CVE-2026-31431 (Copy Fail) detection with Agents”

Datadog Security LabsVendor28 May 2026
From Exploit Code to Production Detection: Building a CVE-2026-31431 (Copy Fail) detection with Agents
“…lege escalation). All of these named vulnerabilities pertain to the Linux kernel’s zero-copy functionality, and are named CopyFail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 and CVE-2026-43500), and Fragnesia (CVE-2026-46300).”

HuntressVendor14 May 2026
Panic at the Distro
“Linux Kernel Vulnerability copy.fail - CVE-2026-31431”

FortiGuard PSIRTVendor13 May 2026
Linux Kernel Vulnerability copy.fail - CVE-2026-31431
“Recent Linux kernel privilege escalation vulnerabilities, Copy Fail (CVE-2026-31431) , Copy Fail 2, and DirtyFrag, highlight how subtle page cache corruption bugs can become practical, reliable paths to root.”

Elastic Security LabsVendor9 May 2026
Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild

Indicators reported together

named in the same reports

process.parent[.]pidin 2 reports
auditd[.]datain 2 reports
copy[.]failin 2 reports

Copy these 3 indicators · defanged

3 indicators, defanged, one per line

process.parent[.]pid
auditd[.]data
copy[.]fail

Also named with it: CVE-2026-43284, CVE-2026-43500, CVE-2026-46300, CVE-2026-31635, CVE-2026-46331, CVE-2022-0847, CVE-2025-8088, CVE-2018-0802, CVE-2017-11882, CVE-2017-0199, CVE-2023-38831, CVE-2025-6218, CVE-2026-43494, CVE-2019-13272, CVE-2021-22555, CVE-2023-32233, CVE-2026-35273

Thanks — we review every report.

Report a wrong value