CVE-2026-31431 in Linux Kernel: Actively Exploited Zero-Day Added to CISA KEV

Technical Analysis

CVE-2026-31431, designated 'Copy Fail', is a vulnerability within the Linux Kernel. While specific technical details of the exploit chain are not available in the provided intelligence, the name suggests a flaw in a memory copy operation, potentially leading to a buffer overflow or memory corruption. Such vulnerabilities in the kernel are typically leveraged for Local Privilege Escalation (LPE), allowing an attacker with initial low-privilege access to gain root-level permissions on the affected host.

The inclusion in the CISA KEV catalog confirms active exploitation, indicating that a functional exploit exists and is being used by threat actors. The lack of a public CVSS score combined with its KEV status is a strong indicator of a zero-day vulnerability that was exploited before a formal public disclosure and analysis could be completed.

Affected Systems

Intelligence Context

The threat profile for CVE-2026-31431 is driven entirely by its CONFIRMED exploitation status. Its addition to the CISA KEV catalog on 2026-05-01 is the single most important data point for prioritization. The EPSS score of 1.23% is currently low, which is typical for newly disclosed zero-days before widespread scanning and exploitation tooling becomes public. Defenders must ignore the low EPSS and absent CVSS score; the KEV listing is a direct mandate for immediate action. The 'ZERO-DAY RACE' label accurately reflects the situation where defenders are patching against an active, ongoing threat.

Remediation & Defense

Source Timeline

• unit42.paloaltonetworks.com — First reporter
• hkcert.org — Advisory confirmation
• cisa.gov/kev — Official exploitation confirmation