VORANT. Threat Intelligence Sign in Get the full feed

Linux kernel Copy Fail privilege escalation exploited

high vulnerability

A local privilege escalation vulnerability (CVE-2026-31431, Copy Fail) in Linux kernel versions 4.14+ is being actively exploited with public proof-of-concept code available.

Japan's IPA has issued an advisory for CVE-2026-31431, dubbed Copy Fail, a privilege escalation vulnerability affecting Linux kernel versions 4.14 and later. The flaw allows local authenticated users to escalate privileges to root level. While the vulnerability requires local access and cannot be exploited remotely over a network (CVSS v3.1: AV:L, PR:L), proof-of-concept exploit code has already been publicly released.

The advisory emphasizes concerns about exploitation when chained with other vulnerabilities, and particularly highlights risks in multi-tenant kernel environments such as container deployments where multiple users share the same kernel. IPA notes that different Linux distributions may be affected by specific kernel versions and recommends consulting distribution-specific security advisories.

Organizations are advised to monitor their Linux distribution vendors for security updates and apply patches as soon as they become available. Some distributions have already released workarounds, though IPA cautions that applying these mitigations may impact system performance and should be thoroughly tested before production deployment.

Mentioned in this report

Vulnerabilities CVE-2026-31431KEV

Detection guidance

Compilation of Exploit Code in World-Writable Directory (Possible Kernel LPE PoC Build)

ATT&CK T1068

Detects invocation of a compiler (gcc/cc/clang) from a temp or world-writable directory, a common step when locally building a Linux kernel privilege-escalation PoC such as CVE-2026-31431 before execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Compiler Invocation From Temp Directory
id: 51917694-a471-5445-b471-fe4d410f21e5
status: experimental
description: Detects a compiler (gcc, cc, clang) being executed with a working directory
  or source path in /tmp, /var/tmp, /dev/shm, or a user home hidden directory. This
  pattern is commonly seen when an attacker builds and compiles a local privilege-escalation
  exploit PoC (e.g. Copy Fail / CVE-2026-31431) on a compromised host prior to execution.
references:
- https://www.ipa.go.jp/
author: Vorant
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
    - /gcc
    - /cc
    - /clang
    - /g++
    CommandLine|contains:
    - /tmp/
    - /var/tmp/
    - /dev/shm/
  filter:
    ParentImage|endswith:
    - /dpkg
    - /apt
    - /rpm
    - /yum
    - /make
  condition: selection and not filter
  falsepositives:
  - Legitimate software builds performed in temporary build directories by CI/CD or
    package managers
  - Developers compiling test code in scratch directories
  level: medium
  tags:
  - attack.t1068
  - attack.privilege_escalation

Unprivileged User Spawning Root Shell From Non-SUID Binary in Temp Path

ATT&CK T1068

Detects a process executed by a non-root user that results in a child process running with root (UID 0) privileges, originating from a binary in a temporary or world-writable directory, indicative of successful exploitation of a local Linux kernel privilege-escalation vulnerability such as Copy Fail (CVE-2026-31431). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Root Privilege Gain From Temp Directory Binary
id: 1aa0ad57-e548-560d-a446-75e51a2836f5
status: experimental
description: Detects execution of a binary located in a world-writable or temporary
  directory (/tmp, /var/tmp, /dev/shm) that runs with effective UID 0, while the parent
  process/session belongs to a non-root user. This pattern is consistent with successful
  local kernel exploitation such as CVE-2026-31431 (Copy Fail), where an unprivileged
  user gains root through an exploit binary rather than a legitimate setuid mechanism.
references:
- https://www.ipa.go.jp/
author: Vorant
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|contains:
    - /tmp/
    - /var/tmp/
    - /dev/shm/
    User: root
  filter:
    ParentUser: root
  condition: selection and not filter
  falsepositives:
  - Administrative scripts intentionally invoking sudo/su from scratch directories
  - Container init scripts that legitimately execute setup binaries from tmpfs as
    root
  level: high
  tags:
  - attack.t1068
  - attack.privilege_escalation

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2026/alert20260501.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free