dailyloe.com – A significant Linux vulnerability, tracked as CVE-2026-31431 and named CopyFail, has emerged, raising concerns among security experts. Released by Theori, the exploit code enables root access to nearly all Linux distributions. The exploit was disclosed publicly on Wednesday after being privately reported to the Linux kernel security team five weeks earlier.
The vulnerability affects versions 7.0, 6.19.12, 6.18.12, 6.12.85, 6.6.137, 6.1.170, 5.15.204, and 5.10.254. However, at the time of the exploit’s release, few Linux distributions had implemented the necessary patches. The flaw allows local privilege escalation, enabling unprivileged users to gain administrative rights.
According to researcher Jorijn Schrijvershof, the exploit can be executed with a single script across all vulnerable distributions. This capability poses a severe risk, as attackers can penetrate multi-tenant systems, escape from containers, and manipulate CI/CD workflows. Schrijvershof explained that an attacker with code execution ability can elevate their privileges to root, allowing them to access files, install backdoors, and target other systems.
The exploit script released by Theori is effective on several platforms, including Ubuntu 22.04, Amazon Linux 2023, SUSE 15.6, and Debian 12. Schrijvershof emphasized the implications of shared infrastructure, noting that the term ‘local’ encompasses various environments, including shared Kubernetes nodes and untrusted CI/CD jobs. The vulnerability disrupts the security boundary between containers and tenants.
The threat chain begins when an attacker exploits a known vulnerability in a WordPress plugin. If successful, this can lead to further exploitation within shared environments. The urgency to address this vulnerability is heightened as defenders work to mitigate potential compromises.
