Le sigh. Every time we go around and have to do this again and manually figure out wtf each of the ten thousand linux distributions provides their security updates and current status.

Spending my Saturday morning searching for CVE-2026-31431 and "copyfail" patch status is just 👍.

Anyway, here's what I have so far:

Alma - https://almalinux.org/blog/2026-05-01-cve-2026-31431-copy-fail/
fixed

Alpine - https://security.alpinelinux.org/vuln/CVE-2026-31431
fixed (per https://fosstodon.org/@alpinelinux/116500119563494081)

Arch - https://security.archlinux.org/CVE-2026-31431
https://security.archlinux.org/AVG-2908
fixed in linux 6.19.12-1

Centos - pending RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=2460538
?

Debian - https://security-tracker.debian.org/tracker/CVE-2026-31431
13 (Trixie), 12 (bookworm), 11 (bullseye) all still vulnerable, but fixed in security releases

#copyfail

Fedora - https://bugzilla.redhat.com/show_bug.cgi?id=2460538
"For any Fedora users finding a link here: this was fixed in kernel 6.19.12, and all current Fedora branches are already at or past that version."

Gentoo - https://bugs.gentoo.org/973385

Kali - should have it by tracking Debian security

Suse / OpenSuse etc. - https://www.suse.com/security/cve/CVE-2026-31431.html

RedHat - https://access.redhat.com/security/cve/cve-2026-31431
relevant for various downstreams

#copyfail

Un kernel Linux patché est disponible pour Debian 11 (5.10.251-3), Debian 12 (6.1.170-1) et Debian 13 (6.12.85-1) : https://security-tracker.debian.org/tracker/CVE-2026-31431
Pour Debian 9 et 10 il faut suivre les paquets de Freexian : https://deb.freexian.com/extended-lts/tracker/CVE-2026-31431
#CopyFail #Debian

Learn how to fix Copy Fail (CVE-2026-31431) in Ubuntu and Linux Mint. Copy Fail vulnerability allows any local user gain root access on Linux.

Full details here: https://ostechnix.com/fix-copy-fail-cve-2026-31431-ubuntu-linux-mint/

#Copyfail #CVE202631431 #Ubuntu #Linuxmint #Security #Linuxkernel

« Mettez à jour le paquet du noyau de votre distribution avec une version incluant le #commit a664bf3d603d de la branche principale », expliquent les chercheurs, « la plupart des principales distributions proposent désormais ce correctif », comme #Debian (https://security-tracker.debian.org/tracker/CVE-2026-31431) (Forky et Sid), #Ubuntu (https://ubuntu.com/security/CVE-2026-31431), par exemple mais la mise en place est encore en cours chez #RedHat (https://access.redhat.com/security/cve/cve-2026-31431) et #Suse.

Fin de l'article.

10/

#Patch #Linux #Ubuntu #CopyFail #Root #Cybersecurity #Docker #Kubernetes

Nine years in the Linux kernel and nobody noticed. "Copy Fail" (CVE-2026-31431) lets any local user grab root in seconds. CISA just added it to KEV. Working exploits for Ubuntu, Amazon Linux, RHEL, SUSE. Patch. - https://www.cisa.gov/news-events/alerts/2026/05/01/cisa-adds-one-known-exploited-vulnerability-catalog

Altro giro di aggiornamenti su vari server per #copyfail #CVE-2026-31431

Rocky - https://kb.ciq.com/article/rocky-linux/rl-cve-2026-31431-mitigation
(couldn't find an official link)

Slackware - nothing on http://www.slackware.com/security/list.php?l=slackware-security&y=2026

Ubuntu - https://ubuntu.com/security/CVE-2026-31431
all around very unclear

#copyfail - ¯\_(ツ)_/¯

I can't tell how dangerous Linux CVE-2026-31431 is, given it's just "local privilege escalation," but updating all my web servers anyway I guess 🤷🏻‍♂️

#Linux #Ubuntu

Copy Fail (CVE-2026-31431) is a Linux kernel LPE that gives root access on every major linux distro.

All that is needed is local shell access and a few lines of python.

https://forum.hashpwn.net/post/12727

#cybersecurity #copyfail #linux #exploit #cve202631431 #hashpwn

C’est l’entreprise de sécurité Xint.io qui a révélé (https://xint.io/blog/copy-fail-linux-distributions), ce mercredi 29 avril, cette vulnérabilité (CVE-2026-31431, d’une sévérité élevée de 7,8/10) permettant une élévation des privilèges en local.

Le score n’est « que » de 7,8 car le vecteur d’attaque est local (AV:L) : il faut déjà avoir un accès local sur la machine, ici un compte utilisateur. La même avec une attaque depuis le réseau (AV:N) se serait approchée de 10.

2/

En utilisant un script Python (https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py) très court (732 octets) qui ne fait appel qu’à des bibliothèques standard et ciblant le page cache du noyau, il est possible d’accéder au binaire qui permet d’être superutilisateur : /usr/bin/su. La modification se fait en mémoire, pas directement sur le périphérique de stockage.

7/

732 bytes to root on every major Linux distro. No race condition. 100% reliable.

That's CVE-2026-31431 (Copy Fail) and it crosses container boundaries, which makes the flood of AI agent sandboxing content this week land differently.
Containers vs gVisor vs microVMs vs Wasm, Lima + libvirt setups, NixOS MicroVMs — all worth a read now.

Also: Claude Code agent teams, PS5 running Linux, Greg KH hunting kernel bugs with a local LLM, and a $20 SFP for 26ns NTP accuracy.

https://www.underkube.com/2026-05-03-what-edu-is-reading-this-week-apr-27-may-3-2026/

Copy Fail: la #vulnerabilidad de #Linux que lleva 9 años escondida y permite obtener root con un script de 732 bytes

https://wwwhatsnew.com/2026/05/02/copy-fail-cve-2026-31431-linux-kernel-vulnerabilidad-ia-mayo-2026/

No setuid. No interactive users. No Python. No shell. Talos Linux barely flinched at Copy Fail. The kernel's still vulnerable and patched kernels shipped before disclosure, but the defaults carried the day. - https://www.siderolabs.com/blog/exploit-fail-cve-2026-31431-copy-fail-barely-scratches-talos-linux

cPanelSniper PoC Exploit Released for CVSS 9.8 Flaw CVE-2026-41940 — 44,000 Servers Already Compromised
#CyberSecurity
https://securebulletin.com/cpanelsniper-poc-exploit-released-for-cvss-9-8-flaw-cve-2026-41940-44000-servers-already-compromised/

Reports: A critical cPanel & WHM zero-day (CVE-2026-41940) is being actively exploited since Feb—attackers can bypass auth to gain full admin access. Patch immediately. 🔥🔐⚠️ Read: https://cyberinsider.com/critical-cpanel-zero-day-auth-bypass-exploited-since-february/ #cPanel #infosec #zeroDay #cybersecurity

2026-W18 — Weekly Threat Roundup

🚨 Critical cPanel authentication bypass (CVE-2026-41940) under mass exploitation for ransomware deployment
🔗 Supply chain attacks hit SAP packages and PyTorch Lightning, stealing developer credentials
👮 Two US cybersecurity professionals sentenced to 4 years for conducting BlackCat ransomware at…

https://threatnoir.com/weekly/2026-w18

#infosec #cybersecurity #threatintel

https://prog.hu/hirek/7088/github-cve-2026-3854-kritikus-rce-sebezhetoseg-kodtar

#magyar #hungarian #GitHub

🔒 CVE-2026-2554: HIGH-severity IDOR in WCFM – Frontend Manager for WooCommerce lets Vendor+ users delete any account, incl. admins. No patch yet. Restrict Vendor access & monitor user deletions. More: https://radar.offseq.com/threat/cve-2026-2554-cwe-639-authorization-bypass-through-d8e3f679 #OffSeq #WordPress #WooCommerce #Infosec

CVE-2026-34159: llama.cpp RPC backend has an unauthenticated, no-bounds-check RCE. Zero buffer field in deserialize_tensor() allows arbitrary memory read/write. No auth, low complexity, CVSS 9.8. Patch to b8492 immediately. #infosec #llamacpp #rce

https://www.valtersit.com/cve/2026/04/cve-2026-34159/

May 3, 2026 Cyber Brief:
AI identities outpacing governance.
Defender exploited (CVE-2026-33825).
Linux LPE added to KEV.
ScreenConnect resurfaces.
ADT breach confirmed.
OFAC freezes $344M in USDT.

Your security stack is now part of your attack surface.

https://thecybermind.co/2026/05/03/executive-brief-may-3-2026/?utm_source=mastodon&utm_medium=jetpack_social

🚨 HIGH-severity XSS (CVE-2026-5063) in NEX-Forms – Ultimate Forms Plugin for WordPress (≤9.1.11): Unauthenticated attackers can inject persistent scripts. No patch yet — disable vulnerable versions and monitor for updates. https://radar.offseq.com/threat/cve-2026-5063-cwe-79-improper-neutralization-of-in-f0ffe501 #OffSeq #XSS #WordPress

SHADOW-EARTH-053: la campagna APT cinese che spia governi asiatici, la NATO e i diplomatici cubani

https://insicurezzadigitale.com/shadow-earth-053-la-campagna-apt-cinese-che-spia-governi-asiatici-la-nato-e-i-diplomatici-cubani/

🚨 HIGH severity buffer overflow in Edimax BR-6208AC (≤1.02) via /goform/setWAN. Exploit public, no vendor fix. Monitor and segment affected devices! CVE-2026-7685 https://radar.offseq.com/threat/cve-2026-7685-buffer-overflow-in-edimax-br-6208ac-c0df4819 #OffSeq #Vuln #IoTSecurity

🚨 HIGH severity: CVE-2026-4061 affects Geo Mashup ≤1.13.18 (WordPress). Unauthenticated SQL injection via 'map_post_type' lets attackers extract sensitive DB data if Geo Search is enabled. Disable Geo Search for now. https://radar.offseq.com/threat/cve-2026-4061-cwe-89-improper-neutralization-of-sp-374a2408 #OffSeq #WordPress #Vuln