Severe Linux Vulnerability Exposes Millions of Devices to Compromise
A newly discovered bug in the Linux kernel, dubbed 'CopyFail,' is allowing attackers to gain complete control of vulnerable Linux systems. The bug, officially tracked as CVE-2026-31431, was disclosed to the Linux kernel security team in late March and patched after about a week, but the patches have yet to fully trickle down to the many Linux distributions that rely on the vulnerable kernel.
The bug, discovered in Linux kernel versions 7.0 and earlier, was publicly released exploit code that allows attackers to take complete control of vulnerable systems. The U.S. government says the bug is now being exploited in the wild, meaning it's being actively used in malicious hacking campaigns.
Affected Systems
- Red Hat Enterprise Linux 10.1
- Ubuntu 24.04 (LTS)
- Amazon Linux 2023
- SUSE 16
How the Bug Works
The bug is called CopyFail because the affected component in the Linux kernel does not copy certain data when it should. This corrupts sensitive data within the kernel, allowing the attacker to piggyback the kernel's access to the rest of the system, including its data.
Consequences of a Successful Compromise
If exploited, the bug is particularly problematic because it allows a regular, limited-access user to gain full-administrator access on an affected Linux system. A successful compromise of a server in a datacenter could allow an attacker to gain access to every application, server, and database of numerous corporate customers, and potentially gain access to other systems on the same network or datacenter.
Prevention and Mitigation
The bug cannot be exploited over the internet on its own, but can be weaponized if used in conjunction with an exploit that works over the internet. Per Microsoft, if the CopyFail bug is chained together with another vulnerability that can be delivered over the internet, an attacker could use the flaw to gain root access to an affected server. A user operating a Linux computer with a vulnerable kernel could also be tricked into opening a malicious link or attachment that triggers the vulnerability.
Government Response
Given the risk to the federal enterprise network, U.S. cybersecurity agency CISA has ordered all civilian federal agencies to patch any affected systems by May 15.
Conclusion
The CopyFail bug is a severe security vulnerability that requires immediate attention from Linux users and administrators. Patches have been released, but the risk of exploitation remains until all affected systems are updated.
Related
- Hackers are actively exploiting a bug in cPanel, used by millions of websites
- Uber wants to turn its millions of drivers into a sensor grid for self-driving companies
- Y Combinator alum Skio sells for $105M cash, only raised $8M, founder says
Sources
- Theori
- Jorijn Schrijvershof
- Zack Whittaker
Contact
Zack Whittaker, Security Editor
zackwhittaker.1337 on Signal