CISA Warns of Linux Kernel Zero-Day Vulnerability Exploited in Active Attacks

**Executive Summary:** CISA has issued an urgent alert for CVE-2026-31431, a Linux kernel "incorrect resource transfer between spheres" (CWE-699) vulnerability that is being actively exploited in the wild; it can enable local privilege escalation to root across enterprise servers, cloud workloads, container/Kubernetes nodes and embedded systems, has been added to the KEV catalog, and federal agencies are required to address it by May 15, 2026. Organizations are advised to apply vendor patches/mitigations immediately, monitor for privilege-escalation activity, and follow BOD 22-01 guidance for cloud assets.