Linux kernel Copy Fail vulnerability enables local privilege escalation
Linux kernel privilege escalation vulnerability CVE-2026-31431 (Copy Fail) allows local users to gain root access; PoC code publicly available.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-31431 as exploited in the wild.
Japan's IPA has issued a security alert regarding CVE-2026-31431, dubbed 'Copy Fail,' a privilege escalation vulnerability in the Linux kernel. The flaw affects Linux kernel versions 4.14 and later. Successful exploitation allows an authenticated local user to escalate privileges to administrator/root level on affected systems. While the vulnerability requires local access and low-level user privileges (CVSS v3.1 Attack Vector: Local, Privileges Required: Low), making it unexploitable over the network, proof-of-concept code has already been publicly released.
The primary concern centers on environments where multiple users share kernel resources, particularly containerized deployments. IPA warns that this vulnerability could be chained with other exploits to achieve remote code execution scenarios. The advisory emphasizes that container orchestration platforms and shared hosting environments face elevated risk due to their multi-tenant nature.
Japan's IPA recommends organizations monitor distribution-specific security advisories and apply patches immediately upon availability. Where patches are unavailable, vendors may provide workarounds, though these may impact system performance. Organizations should test mitigations thoroughly before production deployment. The advisory was published May 1, 2026, with updates issued May 7, 2026.
Mentioned in this report
Detection guidance
Potential Linux Kernel Privilege Escalation via Unexpected Root Process Transition (CVE-2026-31431 Copy Fail)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a process running as root that was spawned by a non-root parent without passing through a recognized privilege-escalation mechanism (sudo/su/pkexec/doas), a behavioural pattern consistent with exploitation of a Linux kernel LPE vulnerability such as CVE-2026-31431. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Potential Linux Kernel Privilege Escalation via Unexpected Root Process Transition
id: ecb3c0d4-6400-5976-8247-a1c5abfa3097
status: experimental
description: 'Detects processes that suddenly execute with root (uid 0) privileges
where the parent process
was running as a non-root user and did not go through a known, legitimate privilege-escalation
path (sudo, su, pkexec, doas, login, sshd, systemd). This pattern is consistent
with abuse of a
Linux kernel privilege escalation vulnerability (e.g. CVE-2026-31431 ''Copy Fail'')
where a local
unprivileged process directly obtains root without invoking standard escalation
tooling.
Requires host telemetry that captures process UID and parent UID (e.g. auditd, Sysmon
for Linux).
'
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1068
- attack.privilege-escalation
logsource:
category: process_creation
product: linux
detection:
selection:
User: root
filter_known_escalation:
ParentImage|endswith:
- /sudo
- /su
- /pkexec
- /doas
- /login
- /sshd
- /systemd
- /systemd-*
- /crond
- /cron
- /runc
- /containerd-shim
filter_root_parent:
ParentUser: root
condition: selection and not filter_known_escalation and not filter_root_parent
falsepositives:
- Legitimate setuid binaries or system services that intentionally transition to root
outside of sudo/su (e.g. custom service managers)
- Container runtime init processes that start as root by design in certain minimal
container images
- Administrative scripts using non-standard privilege elevation wrappers not included
in the filter list
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2026/alert20260501.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs