Exploited vulnerabilitiesBriefConfirmed by two or more outlets
Linux “Copy Fail” page-cache corruption local root (CVE-2026-31431)
An unprivileged user corrupts the in-memory page cache of any readable file, including setuid binaries, and gets root.
- Disclosed
What happened
- An unprivileged user corrupts the in-memory page cache of any readable file, including setuid binaries, and gets root. Microsoft says it is relevant across cloud and container hosts.
- KEV: 1 May 2026. Public PoC. CERT-EU advisory 2026-005.
Live scores
Live scores
CVE-2026-31431- EPSS
- 0.981
very likely to be attacked soon - VEDAS
- 0.987
strong exploit evidence - On CISA KEV
- Yes, since 2026-05-01
- Detection rule
- Out of scope (local)
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
- https://www.microsoft.com/en-us/security/blog/2026/05/01/cve-2026-31431-copy-fail-vulnerability-enables-linux-root-privilege-escalation/
- https://cert.europa.eu/publications/security-advisories/2026-005/
- https://thehackernews.com/2026/05/cisa-adds-actively-exploited-linux-root.html
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.