# Linux kernel Copy Fail privilege escalation exploited

Published: 2026-05-06 · Severity: high
Canonical: https://vorant.io/reports/06184521-495e-5925-97fd-09ce3ee44a41/linux-kernel-copy-fail-privilege-escalation-exploited

> A local privilege escalation vulnerability (CVE-2026-31431, Copy Fail) in Linux kernel versions 4.14+ is being actively exploited with public proof-of-concept code available.

Japan's IPA has issued an advisory for CVE-2026-31431, dubbed Copy Fail, a privilege escalation vulnerability affecting Linux kernel versions 4.14 and later. The flaw allows local authenticated users to escalate privileges to root level. While the vulnerability requires local access and cannot be exploited remotely over a network (CVSS v3.1: AV:L, PR:L), proof-of-concept exploit code has already been publicly released.

The advisory emphasizes concerns about exploitation when chained with other vulnerabilities, and particularly highlights risks in multi-tenant kernel environments such as container deployments where multiple users share the same kernel. IPA notes that different Linux distributions may be affected by specific kernel versions and recommends consulting distribution-specific security advisories.

Organizations are advised to monitor their Linux distribution vendors for security updates and apply patches as soon as they become available. Some distributions have already released workarounds, though IPA cautions that applying these mitigations may impact system performance and should be thoroughly tested before production deployment.

## Mentioned in this report

- Vulnerabilities: CVE-2026-31431 (KEV)

## Detection guidance (public sample)

### Compilation of Exploit Code in World-Writable Directory (Possible Kernel LPE PoC Build)

ATT&CK: T1068

Detects invocation of a compiler (gcc/cc/clang) from a temp or world-writable directory, a common step when locally building a Linux kernel privilege-escalation PoC such as CVE-2026-31431 before execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Compiler Invocation From Temp Directory
id: 51917694-a471-5445-b471-fe4d410f21e5
status: experimental
description: Detects a compiler (gcc, cc, clang) being executed with a working directory
  or source path in /tmp, /var/tmp, /dev/shm, or a user home hidden directory. This
  pattern is commonly seen when an attacker builds and compiles a local privilege-escalation
  exploit PoC (e.g. Copy Fail / CVE-2026-31431) on a compromised host prior to execution.
references:
- https://www.ipa.go.jp/
author: Vorant
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
    - /gcc
    - /cc
    - /clang
    - /g++
    CommandLine|contains:
    - /tmp/
    - /var/tmp/
    - /dev/shm/
  filter:
    ParentImage|endswith:
    - /dpkg
    - /apt
    - /rpm
    - /yum
    - /make
  condition: selection and not filter
  falsepositives:
  - Legitimate software builds performed in temporary build directories by CI/CD or
    package managers
  - Developers compiling test code in scratch directories
  level: medium
  tags:
  - attack.t1068
  - attack.privilege_escalation
```

### Unprivileged User Spawning Root Shell From Non-SUID Binary in Temp Path

ATT&CK: T1068

Detects a process executed by a non-root user that results in a child process running with root (UID 0) privileges, originating from a binary in a temporary or world-writable directory, indicative of successful exploitation of a local Linux kernel privilege-escalation vulnerability such as Copy Fail (CVE-2026-31431). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Root Privilege Gain From Temp Directory Binary
id: 1aa0ad57-e548-560d-a446-75e51a2836f5
status: experimental
description: Detects execution of a binary located in a world-writable or temporary
  directory (/tmp, /var/tmp, /dev/shm) that runs with effective UID 0, while the parent
  process/session belongs to a non-root user. This pattern is consistent with successful
  local kernel exploitation such as CVE-2026-31431 (Copy Fail), where an unprivileged
  user gains root through an exploit binary rather than a legitimate setuid mechanism.
references:
- https://www.ipa.go.jp/
author: Vorant
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|contains:
    - /tmp/
    - /var/tmp/
    - /dev/shm/
    User: root
  filter:
    ParentUser: root
  condition: selection and not filter
  falsepositives:
  - Administrative scripts intentionally invoking sudo/su from scratch directories
  - Container init scripts that legitimately execute setup binaries from tmpfs as
    root
  level: high
  tags:
  - attack.t1068
  - attack.privilege_escalation
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2026/alert20260501.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/06184521-495e-5925-97fd-09ce3ee44a41/linux-kernel-copy-fail-privilege-escalation-exploited.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup