Attackers are cashing in on fresh 'CopyFail' Linux flaw

CVE-2026-31431 (“CopyFail”) is a Linux kernel flaw that allows low-privilege users to modify data they should only be able to read, enabling reliable local privilege escalation to root across mainstream kernels since 2017; a public Python PoC works unmodified across multiple major distributions, prompting immediate patches, CISA KEV listing with an emergency patch deadline, and Microsoft warnings of observed exploitation/testing.