CVE-2026-31431 ('Copy Fail') is a Linux kernel vulnerability impacting the authencesn AEAD template, allowing authenticated attackers with code execution privileges to modify in-memory cache pages of setuid-root binaries to escalate privileges to root. The flaw has existed since 2017 and affects all Linux distributions using the vulnerable kernel versions. Exploitation leads to full root access, enabling container breakout and lateral movement, especially in environments with untrusted code execution such as cloud and container orchestration platforms. Limited exploitation has been observed, primarily associated with proof-of-concept testing. CISA has added the vulnerability to its KEV list, urging rapid patching. Microsoft highlights the vulnerability's stealth and cross-platform applicability, recommending prioritization of detection and mitigation efforts.

The vulnerability allows local, authenticated attackers with code execution privileges to escalate to full root privileges, impacting confidentiality, integrity, and availability. This can facilitate container breakout, compromise of multi-tenant environments, and lateral movement within shared infrastructure. The vulnerability's stealthy in-memory-only modifications increase the difficulty of detection. Although currently observed exploitation is limited and mainly PoC-related, the broad applicability and availability of a working exploit pose a significant risk, especially in cloud, CI/CD, and Kubernetes environments.

Patch status is not explicitly confirmed in the provided data; users should consult vendor advisories for current remediation guidance. CISA has added the vulnerability to its KEV catalog and urges federal agencies to patch within two weeks, indicating that patches or mitigations are expected or available. Organizations should prioritize identifying vulnerable systems, apply available patches promptly, isolate affected machines, enforce strict access controls, and review system logs for signs of exploitation. Given the stealthy nature of the exploit, monitoring for anomalous behavior related to privilege escalation is recommended.