The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding active exploitation of the Linux kernel vulnerability CVE-2026-31431, dubbed “Copy Fail,” which enables unprivileged or low-privileged users to escalate privileges to root across a wide range of Linux systems. Disclosed by Theori alongside a proof-of-concept exploit, the flaw exists in the kernel’s AEAD cryptographic interface and allows attackers to write controlled data to the page cache of readable or setuid-root binaries, effectively granting full system control. The vulnerability impacts nearly all major Linux distributions including Ubuntu 24.04 LTS, Amazon Linux 2023, Red Hat Enterprise Linux 10.1, and SUSE Linux Enterprise 16, and affects kernels built since 2017, dramatically expanding its attack surface. While Microsoft reports that current in-the-wild activity is limited and largely tied to proof-of-concept testing, it highlights the vulnerability’s high risk due to its reliability, stealthy in-memory execution, and applicability in cloud, containerized, and multi-tenant environments, where it can facilitate container escape, lateral movement, and broader compromise. CISA has added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog mandating remediation within two (2) weeks. CTIX analysts urge impacted organizations to prioritize patching, identify vulnerable assets, restrict access, and monitor for exploitation attempts, particularly as attackers can chain the flaw with SSH access, malicious CI/CD jobs, or container footholds to achieve root shell access.