# Linux kernel privilege escalation vulnerability CVE-2026-31431 (Copy Fail) allows local…

Published: 2026-05-06 · Severity: high
Canonical: https://vorant.io/reports/136f872b-fd9a-4816-aa6f-de562e393fd1/linux-kernel-privilege-escalation-vulnerability-cve-2026-31431-copy-fail-allows

> Linux kernel privilege escalation vulnerability CVE-2026-31431 (Copy Fail) allows local users to gain root access; PoC code publicly available.

Japan's IPA has issued a security alert regarding CVE-2026-31431, dubbed 'Copy Fail,' a privilege escalation vulnerability in the Linux kernel. The flaw affects Linux kernel versions 4.14 and later. Successful exploitation allows an authenticated local user to escalate privileges to administrator/root level on affected systems. While the vulnerability requires local access and low-level user privileges (CVSS v3.1 Attack Vector: Local, Privileges Required: Low), making it unexploitable over the network, proof-of-concept code has already been publicly released.

The primary concern centers on environments where multiple users share kernel resources, particularly containerized deployments. IPA warns that this vulnerability could be chained with other exploits to achieve remote code execution scenarios. The advisory emphasizes that container orchestration platforms and shared hosting environments face elevated risk due to their multi-tenant nature.

Japan's IPA recommends organizations monitor distribution-specific security advisories and apply patches immediately upon availability. Where patches are unavailable, vendors may provide workarounds, though these may impact system performance. Organizations should test mitigations thoroughly before production deployment. The advisory was published May 1, 2026, with updates issued May 7, 2026.

## Mentioned in this report

- Vulnerabilities: CVE-2026-31431 (KEV)

## Detection guidance (public sample)

### Potential Linux Kernel Privilege Escalation via Unexpected Root Process Transition (CVE-2026-31431 Copy Fail)

ATT&CK: T1068

Detects a process running as root that was spawned by a non-root parent without passing through a recognized privilege-escalation mechanism (sudo/su/pkexec/doas), a behavioural pattern consistent with exploitation of a Linux kernel LPE vulnerability such as CVE-2026-31431. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Potential Linux Kernel Privilege Escalation via Unexpected Root Process Transition
id: ecb3c0d4-6400-5976-8247-a1c5abfa3097
status: experimental
description: 'Detects processes that suddenly execute with root (uid 0) privileges
  where the parent process

  was running as a non-root user and did not go through a known, legitimate privilege-escalation

  path (sudo, su, pkexec, doas, login, sshd, systemd). This pattern is consistent
  with abuse of a

  Linux kernel privilege escalation vulnerability (e.g. CVE-2026-31431 ''Copy Fail'')
  where a local

  unprivileged process directly obtains root without invoking standard escalation
  tooling.

  Requires host telemetry that captures process UID and parent UID (e.g. auditd, Sysmon
  for Linux).

  '
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1068
- attack.privilege-escalation
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    User: root
  filter_known_escalation:
    ParentImage|endswith:
    - /sudo
    - /su
    - /pkexec
    - /doas
    - /login
    - /sshd
    - /systemd
    - /systemd-*
    - /crond
    - /cron
    - /runc
    - /containerd-shim
  filter_root_parent:
    ParentUser: root
  condition: selection and not filter_known_escalation and not filter_root_parent
falsepositives:
- Legitimate setuid binaries or system services that intentionally transition to root
  outside of sudo/su (e.g. custom service managers)
- Container runtime init processes that start as root by design in certain minimal
  container images
- Administrative scripts using non-standard privilege elevation wrappers not included
  in the filter list
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2026/alert20260501.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/136f872b-fd9a-4816-aa6f-de562e393fd1/linux-kernel-privilege-escalation-vulnerability-cve-2026-31431-copy-fail-allows.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup