CISA says ‘Copy Fail’ flaw now exploited to root Linux systems

CVE-2026-31431 (“Copy Fail”) is a Linux kernel privilege-escalation vulnerability in the algif_aead cryptographic interface that Theori disclosed with a reportedly reliable PoC capable of rooting multiple mainstream distributions; CISA confirmed in-the-wild exploitation, added the flaw to its KEV catalog, and ordered federal agencies to patch within two weeks.