Loading story…
CVE-2026-31431 is a Linux kernel flaw classified as CWE-669: Incorrect Resource Transfer Between Spheres that can enable local privilege escalation to root and, in some cases, bypass isolation boundaries. The Canadian Centre for Cyber Security warned that the impact becomes more severe when the bug is chained with a remote code execution vulnerability, and urged organizations to identify exposed systems, apply vendor fixes, reboot after kernel updates, restrict access, enforce kernel security controls, monitor logs, and segment high-risk or Internet-facing workloads.
Vendor and community activity indicates broad exposure across modern Linux platforms. Red Hat lists RHEL 8, RHEL 9, RHEL 10, and corresponding kernel-rt packages as affected, while RHEL 6 and RHEL 7 are marked not affected because the vulnerable code is absent. Public exploit interest accelerated after Theori published the "Copy Fail" technical write-up and proof-of-concept repository, which references testing on Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16; Rocky Linux also published related errata, signaling downstream patch availability in enterprise Linux ecosystems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published Alert AL26-009 warning that CVE-2026-31431 could enable privilege escalation to root or bypass isolation mechanisms on vulnerable Linux systems. The alert stressed higher risk when chained with remote code execution and urged organizations to identify affected systems, apply patches, reboot, and harden exposed workloads.
A GitHub repository by theori-io published a technical write-up and proof-of-concept exploit for 'Copy Fail' (CVE-2026-31431), including exploit code and tested kernel/distribution details. The repository quickly drew broad public attention, indicating active security community interest in exploitation details.
Red Hat's CVE page identifies Red Hat OpenShift Container Platform 4 rhcos as affected by CVE-2026-31431, expanding the known impact beyond the RHEL kernel packages already noted. The same page continues to mark RHEL 6, RHEL 7, and RHEL 7 kernel-rt as not affected because the vulnerable code is not present.
Red Hat's product impact matrix for CVE-2026-31431 states that RHEL 8, RHEL 8 kernel-rt, RHEL 9, RHEL 9 kernel-rt, and RHEL 10 kernel are affected, while RHEL 6, RHEL 7, and RHEL 7 kernel-rt are not affected because the vulnerable code is not present.
Rocky Linux issued product errata RLSA-2026:12265 and RLSA-2026:12271 related to CVE-2026-31431, indicating vendor remediation activity for affected systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcegithub.com
Open sourceerrata.rockylinux.org
Open sourceerrata.rockylinux.org
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat disclosed **CVE-2026-46331**, an important local privilege escalation vulnerability in the Linux kernel’s traffic control subsystem, specifically the `act_pedit` module. The flaw stems from a missing bounds check in `tcf_pedit_act()` that can lead to an out-of-bounds write and page cache memory corruption, potentially allowing a local user to gain **root** privileges. Red Hat said **RHEL 8, 9, and 10** are directly affected, along with **Red Hat Enterprise Linux for NVIDIA** and **Red Hat OpenShift Container Platform**, though OpenShift exposure is considered low because the vulnerable module is not loaded by default. Technical details show the bug arises when packet-editing keys recompute Layer 4 offsets during processing, allowing an earlier mutation to influence a later write beyond the originally validated writable packet range. Red Hat has issued fixes across multiple product lines, including RHEL variants, SAP Solutions, Telecommunications Update Service, Extended Update Support, Advanced Mission Critical Update Support, and NVIDIA for RHEL 10, while warning that products built on the RHEL kernel such as **RHEL CoreOS**, **Red Hat OpenStack Platform**, and **Red Hat Virtualization** may also be impacted. As a mitigation, Red Hat advised administrators to blacklist the `act_pedit` kernel module and verify whether it is loaded before unloading it or rebooting.
Jun 29, 2026
Public proof-of-concept exploit code was released for **DirtyDecrypt** (`CVE-2026-31635`), a high-severity Linux kernel local privilege escalation flaw caused by a missing copy-on-write guard in `rxgk_decrypt_skb()` within the RxGK subsystem. The bug allows unprivileged local users to corrupt shared page-cache memory tied to privileged files or processes, potentially overwriting targets such as `/etc/shadow`, `/etc/sudoers`, or SUID binaries to gain **root**. Reports said the issue was quietly patched upstream in late April and primarily affects systems using mainline or rolling-release kernels with `CONFIG_RXGK` enabled, including **Fedora**, **Arch Linux**, and **openSUSE Tumbleweed**; the risk is elevated on Kubernetes worker nodes and developer workstations because exploitation can also enable container escape and theft of secrets or runtime sockets. At the same time, researchers disclosed **PinTheft**, another Linux local privilege escalation exploit that abuses a double-free or refcount bug in the **RDS zerocopy send path** and uses `io_uring` fixed buffers to turn the flaw into a page-cache overwrite against a SUID-root binary. The exploit, credited to Aaron Esau of V12 Security, reportedly drains page references through failed RDS zerocopy sends, frees the page, reclaims it as page cache, and overwrites it with a malicious ELF payload that yields a root shell when executed. Mailing list discussion said a patch and proof of concept are available, with exploitability depending on the `rds` kernel module being present or autoloadable; **Arch Linux** was reported to enable it by default, while Fedora may also be exposed and Debian and Ubuntu appear to have mitigations that restrict autoloading.
Jun 29, 2026
Researchers and vendors disclosed **CVE-2026-46333**, a Linux kernel flaw in `__ptrace_may_access()` that lets an unprivileged local user exploit a process-exit race to bypass authorization checks and steal file descriptors from privileged processes. The bug has existed since Linux `v4.10-rc1`, and exploitation became more practical with `pidfd_getfd()` introduced in `v5.6-rc1`. Qualys and public proof-of-concept authors showed the issue can expose `/etc/shadow`, leak OpenSSH host private keys through `ssh-keysign`, and in some cases execute commands as root via targets including `chage`, `pkexec`, and `accounts-daemon` on default Debian, Ubuntu, Fedora, AlmaLinux, and other distributions. Linus Torvalds merged the upstream fix in commit `31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a`, and stable kernel updates were released across multiple branches as distributions began shipping patched packages. Public exploit code appeared almost immediately after the fix became visible, increasing the urgency for defenders to patch and reboot affected systems, rotate potentially exposed **SSH host keys** and other credentials, and review systems for local privilege-escalation activity. Where immediate patching is not possible, several vendors and Qualys said raising `kernel.yama.ptrace_scope` to `2` or `3` can block known exploit paths, although maintainers cautioned that such settings are only a temporary workaround and may disrupt debugging tools.
Jun 29, 2026