CISA flags actively exploited ‘Copy Fail’ Linux kernel flaw enabling root takeover across major distros — unpatched systems may remain vulnerable to attack

Linux penguins.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a newly disclosed Linux vulnerability, dubbed “Copy Fail,” to its Known Exploited Vulnerabilities catalog on May 1st, warning that the flaw, tracked as CVE-2026-31431, is already being used in active attacks and urging rapid patching across affected systems.

Tom's Hardware Premium Roadmaps

(Image credit: Future)

• High-Bandwidth Memory (HBM) Roadmap
• Nvidia Enterprise GPU and CPU Roadmap
• AI accelerator Roadmap
• Desktop GPU Roadmap
• 3D NAND Roadmap