Skip to content
Trending Vulnerabilities

Why it is trending

CVE-2026-31431

Linux kernel (Intel IoTG Real-time) vulnerabilities

Known-bad
  • CVSS 7.8
  • CIRCL KEV
  • CISA KEV
  • CISA SSVC: active
  • ENISA KEV
  • VulnCheck KEV
  • Metasploit
  • +1
Buzz
23discussion, 0-100
Danger
70exploitability, 0-100
Mentions
74since 29 Apr 2026
EPSS
3.4%exploit probability
Mentions Per Day · UTCpeak 3
29 days agoToday
Where The Talk Is · by platform74 total
  • GitHub38 mentions · 38 voices · 37 PoC
  • X35 mentions · 18 voices
  • Reddit1 mentions · 1 voices
Newest Public Posts · plain text, newest first

X

  • Escondido y sin darle demasiado bombo, veo correcciones a CVE-2026-31431 y CVE-2026-67280 en la última estable de RouterOS (7.25)... y es viernes. https://t.co/bkvK0Boeum

    @overdrv12 h agolikes 2views 134replies 1Open
  • Copy Fail (CVE-2026-31431): 732 bytes para conseguir root en cualquier Linux desde 2017 https://t.co/ObmGA2Aeh1

    @l0rdmalware7 d agolikes 0views 12replies 0Open
  • Copy Fail (CVE-2026-31431): 732 bytes to root on every Linux since 2017 https://t.co/6CD3o0bSUj

    @l0rdmalware7 d agolikes 0views 11replies 0Open
  • Walkthrough Thursday is back! Join Amos Maina on 22 October, 8–9 PM EAT, for a vault walkthrough of Copy Fail (CVE-2026-31431). 🔗 Join us: https://t.co/HzEyzEd1VV #CTFROOM #Cybersecurity #WalkthroughThursday #CVE https://t.co/LEFZOO8Wqc

    @CTF_Room9 d agolikes 0views 100replies 0Open
  • CVE-2026-31431 のPoCコード実行するか!!

    @nanashi_king_t10 d agolikes 1views 359replies 0Open
  • You can corrupt /bin/su in memory, get a root shell, and when the system reboots the file on disk is completely clean. No dirty page flag. No writeback. No forensic trace. This is Copy Fail (CVE-2026-31431). A 4-byte write through Linux's crypto subsystem that's been silently exploitable since 2017…

    @sankethbk777713 d agolikes 1views 50replies 1Open
  • This article examines why Copy Fail (CVE-2026-31431) breaks container assumptions and provides a small, safe Python check to determine whether your nodes can reach the vulnerable kernel path ➤ https://t.co/kkHUzi6oyz

    @kubesploit14 d agolikes 6views 800replies 0Open
  • Copy Fail(CVE-2026-31431 )のEPSSが9/24に突然急低下しているんだけど、何があったんだろう。 https://t.co/xq7PE4vaLT

    @SecurityPome18 d agolikes 0views 17replies 0Open
  • Linux kernel 7.3-rc5 dropped Sept 27. 400+ CVEs in 24h because GregKH now stamps a CVE on every backported typo fix. Copy Fail (CVE-2026-31431) still unpatched on Debian Stable. Dirty Frag (CVE-2026-43284) makes it two universal LPEs in eight days. Your kernel is not patched unless you rebooted *to…

    @itimorin22 d agolikes 0views 47replies 0Open
  • 【現場エンジニアのための「Proxmox VE」活用術】 インストール直後のProxmox VEはISO作成時点のパッケージセットのまま。第3回はリポジトリ構成を理解しながらホストを最新化する。 📦 リポジトリは2系統 ProxmoxリポジトリにはProxmoxカーネル(Ubuntuカーネルのカスタマイズ版)と独自パッケージ ZFS・Ceph・QEMU/KVMも独自ビルド版が提供され、-pveのリビジョンによりAPTの通常ルールでProxmox版が優先される 🎚️ Test / No-subscription / Enterprise 誤解を恐れずに言えばアルファ版・ベータ版・正式版。機能差…

    @thinkitcojp24 d agolikes 2views 327replies 1Open

GitHub

  • StackOverflowExcept1on/CVE-2026-31431: Copy Fail exploit for Ubuntu 20.04 with legacy Python versions, including script to hide Copy Fail.

    StackOverflowExcept1on/CVE-2026-3143115 h agostars 0PoCOpen
  • codesource/copyfail-check: Archived, moved to codesource/cve-check. Shell script to detect CVE-2026-31431 (Copy Fail) exposure and mitigations on Linux systems: kernel check, module state, boot params, AF_ALG reachability, and distro patch status.

    codesource/copyfail-check2 d agostars 2PoCOpen
  • codesource/cve-check: Shell scripts that check Linux hosts for known vulnerabilities (PHP CVE-2026-109618/109619, Copy Fail CVE-2026-31431), report vulnerable, mitigated or fine, and apply the fix on request with --fix.

    codesource/cve-check2 d agostars 0PoCOpen
  • abdelkabirouadoukou/CVE-2026-31431-Analysis-and-Fix: Technical deep dive, root cause analysis, and LKML patch workflow for CVE-2026-31431 (Linux kernel local privilege escalation in algif_aead).

    abdelkabirouadoukou/CVE-2026-31431-Analysis-and-Fix7 d agostars 2Open
  • Industri4l-H3ll-Xpl0it3rs/CVE-2026-31431-Copy-Fail: CVE-2026-31431 Exploit | by infrar3d

    Industri4l-H3ll-Xpl0it3rs/CVE-2026-31431-Copy-Fail7 d agostars 0PoCOpen
  • John-Popovici/CVE-2026-31431-CopyFail-Linux-PrivEsc: A demo and explanation of CVE-2026-31431

    John-Popovici/CVE-2026-31431-CopyFail-Linux-PrivEsc11 d agostars 0PoCOpen
  • ledlight33/copyfail-check-skill: Read-only Copy Fail (CVE-2026-31431) check, packaged as an agent skill

    ledlight33/copyfail-check-skill19 d agostars 0PoCOpen
  • ledlight33/copyfail-dfir: Interactive DFIR walkthrough of CVE-2026-31431 (Copy Fail) - from SIEM alert to confirmed verdict. Real Volatility 3 commands, verified methodology.

    ledlight33/copyfail-dfir20 d agostars 2PoCOpen
  • ZeroDayEvil/CVE-2026-31431: 🛡️ Official AI Security Tool module for CVE-2026-31431 ("Copy Fail" / Linux algif_aead page-cache scratch-write LPE Exploit & Detector).

    ZeroDayEvil/CVE-2026-3143125 d agostars 26PoCOpen
  • Lutfifakee-Project/CVE-2026-31431: CVE-2026-31431 - Linux Kernel Page Cache Vulnerability

    Lutfifakee-Project/CVE-2026-3143126 d agostars 1PoCOpen

Reddit

  • Trending Threats & Vulnerabilities: Linux Copy Fail (CVE-2026-31431) — CrowdStrike Falcon has detection coverage for Copy Fail. These include but are not limited to: Endpoint IOAs Rapid Response Content Information Falcon Exposure Management Assessments Falcon Cloud Security Image Assessments Detai…

    r/crowdstrike176 d agoOpen
Public PoC Repositories · third-party code10 links

Links are collected from public posts and are not reviewed by Brandefense. Exploit code can be unsafe or malicious: only study it in an isolated lab, and never run it against systems you do not own.

Get a morning brief and an alert the moment a critical vulnerability like this one starts trending.

Subscribe