---
schema: 1
kind: threat
title: "CVE-2026-31431 \"Copy Fail\" — CISA KEV deadline 2026-05-15 approaching; Microsoft documents Linux LPE cluster post-compromise chain"
headline: "CVE-2026-31431 \"Copy Fail\" — CISA KEV deadline 2026-05-15 approaching; Microsoft documents Linux LPE cluster post-compromise chain"
summary: "UPDATE (originally covered 2026-05-06):"
discovered_at: "2026-05-09T05:00:15Z"
event_date: null
run_id: 2026-05-09-migrated
priority: notable
immediate_action: null
tags:
  - vulnerabilities
  - actively-exploited
  - cisa-kev
  - lpe
regions:
  - global
sectors: []
entities: []
cves: []
sources:
  - url: "https://www.microsoft.com/en-us/security/blog/2026/05/08/active-attack-dirty-frag-linux-vulnerability-expands-post-compromise-risk/"
    publisher: "Microsoft Security Blog, 2026-05-08"
    role: primary
  - url: "https://cert.europa.eu/publications/security-advisories/2026-005/"
    publisher: "CERT-EUROPA advisory 2026-005 update, 2026-05-08"
    role: corroborating
  - url: "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
    publisher: CISA KEV entry CVE-2026-31431
    role: corroborating
closed_sources: []
evidence: []
verification: multi-source
sourcing_note: "migration: update target unresolved (originally covered 2026-05-06)"
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
watchlist_hit: false
actions: []
migrated_from: briefs/2026-05-09.md
---

**UPDATE (originally covered 2026-05-06):**

CISA added CVE-2026-31431 to KEV on 2026-05-06 with a federal remediation deadline of **2026-05-15** — six days from today. Organisations with unpatched Linux kernel deployments running the `algif_aead` module (present by default on most distributions unless FIPS mode is active) are approaching the federal deadline. Downstream distribution patches: Ubuntu 22.04/24.04 (linux-image 6.1.98-1ubuntu1); RHEL 8/9 (kernel-5.14.0-503.14.1); Debian 12 (pending as of 2026-05-09 06:00 UTC).

Material update: The Microsoft Security Blog post published on 2026-05-08 (same post covering "Dirty Frag") provides new detail on the "Copy Fail" cluster. Microsoft observes that threat actors are using CVE-2026-31431 and CVE-2026-43284/43500 (Dirty Frag) as **complementary techniques** in post-compromise Linux privilege escalation operations — deploying CVE-2026-31431 on hosts where the `algif_aead` module is available and `rxrpc`/`esp*` are not, and Dirty Frag on hosts where user namespaces are enabled without `algif_aead`. The same initial access vector (SSH-based credential stuffing with exposed management ports) is used across both chains. This operationalises the two LPE vulnerabilities as a "pair" covering different Linux deployment configurations.