Has it been fixed? If so, in which kernel versions, please.
Surely an organ like The Register could give some actual concrete information about failing and fixed versions.
Attackers are cashing in on fresh 'CopyFail' Linux flaw
CISA is warning that a newly-disclosed Linux kernel bug dubbed "CopyFail" is already being exploited, just days after researchers dropped a working root-level exploit. Tracked as CVE-2026-31431, the bug sits in the Linux kernel and gives low-level users a way to take full control of a system by modifying data they should only …
-
-
-
Wednesday 6th May 2026 09:16 GMT ibmalone
Re: Has it been fixed? If so, in which kernel versions, please.
This is presumably why they haven't listed specific versions, because although mainstream kernels are fixed different vendors may also backport. Alma9 for example has kernel-5.14.0-611.49.2.el9_7 while RHEL9 has patches in 5.14.0-611.54.1.
-
-
Wednesday 6th May 2026 07:10 GMT FirstTangoInParis
Re: Has it been fixed? If so, in which kernel versions, please.
Indeed. I tested my three most important Ubuntu servers doing file and web serving against the cert-eu vulnerability test instructions and none were found to need patching.
Looks like it’s only a problem if you have the vulnerable kernel module installed.
-
Tuesday 5th May 2026 18:29 GMT Anonymous Coward
Re: Has it been fixed? If so, in which kernel versions, please.
Surely an organ like The Register could give some actual concrete information about failing and fixed versions.
including technical detail like that would just confuse the management types who frequent these pages these days.
better to hint at things so pertinent answers to unheard questions can be put into the inevitable follow up article.
https://copy.fail lists the details and fixes.
this was made public on 2026-04-29 as per the timeline on that page
-
Tuesday 5th May 2026 19:20 GMT Taliesinawen
Re: Has it been fixed? If so, in which kernel versions, please.
“Copy Fail (CVE-2026-31431) is a logic bug in the Linux kernel's authencesn cryptographic template. It lets an unprivileged local user trigger a deterministic, controlled 4-byte write into the page cache of any readable file on the system. A single 732-byte Python script can edit a setuid binary and obtain root on essentially all Linux distributions shipped since 2017.”
-
Tuesday 5th May 2026 21:37 GMT MonkeyJuice
Re: Has it been fixed? If so, in which kernel versions, please.
As a side effect it also breaks subsequent cached executions of
suso it stops requesting a password and you have now unlocked the front door for anyone else who can execute it. I hope you remembered to reset after determining you were vulnerable...
-
-
-
-
Tuesday 5th May 2026 18:41 GMT MonkeyJuice
The timeline on this one was a bit ungentlemanly imo
They dropped a root shell to salivating script kiddies before the patches were even IN Debian. Mitigations worked (and yes, technically the kernel could be manually patched and recompiled at a push) but at least give the major distros time to have shipped the new kernel images through the regular channels.
-
Tuesday 5th May 2026 21:33 GMT VoiceOfTruth
Downplayed by the Linux community
I can imagine the finger pointing by penguins if this happened in Windows land.
Who on earth thought it was ever right to undo what is meant by 'read only'? Somebody dropped an enormous clanger here. It makes me wonder what other stupidities and undoings of things we take for granted have crept into Linux.
-
Wednesday 6th May 2026 07:27 GMT ItsAllGonePeteTong
Re: Downplayed by the Linux community
Oh no doubt their will be other clangers in there, but that's the nature of the beast. All software is like this.
But Microsoft don't get off scott free here either, they've had vulnerabilities surface that have been in the system for years. They usually get a bit longer to patch and sort it out too.
This vulnerability issue isn't a Windows versus Linux issue, it's the nature of software written with many complex moving parts. The odd bug is gonna appear, be it in Windows or Linux.
The cool bit is how fast the Linux world responded and provided mitigating patches.
-
-
-
Wednesday 6th May 2026 12:29 GMT Anonymous Coward
Re: Downplayed by the Linux community
So twenty years of "So many eyes on the code!" and "given enough eyeballs, all bugs are shallow" beaten into our heads, all of a sudden that hubris is dismissed because one of the world's largest-surface bugs gets acknowledged quickly?
As Jim Zemlin said, "In these cases, the eyeballs weren't really looking".
-
Thursday 7th May 2026 09:55 GMT werdsmith
Re: Downplayed by the Linux community
No-one is claiming this, and no-one has claimed anything like this. Except people like you, of course.
Really? I must have been hallucinating all these years then.
It's the denial that is the problem, along with the ridiculous sanctimony. Imagine how much further forward Linux could have been without these wankers.
-
-
-
Wednesday 6th May 2026 13:36 GMT VoiceOfTruth
Re: Downplayed by the Linux community
There you go... downplaying it.
If read only does not mean read only, then that is a major problem. I wonder what else has gone wrong in the Linux world when I read this. Somebody somewhere tried to be clever, and totally negated the meaning of the words 'read only'.
-
Wednesday 13th May 2026 12:33 GMT anonymous boring coward
Re: Downplayed by the Linux community
It’s not intentional. It’s some kind of bug, which is evident from the text “… opening a path to tamper with cached data in ways that were never meant to be user-controlled”.
You do understand that “read only” is a concept? It’s not that data is turned into stone somewhere, nor stored in EEPROM suddenly. If data is moved, and cached, the read only status has to be managed along with it, and enforced as well. The actual movement (copy+delete) requires writing, so the read only status has to be set after this operation and utilise a privileged, protected, operator.
-
-
-
