Linux Kernel Privilege Escalation CVE-2026-31431 Draws Patch and PoC Activity

CVE-2026-31431 is a Linux kernel flaw classified as CWE-669: Incorrect Resource Transfer Between Spheres that can enable local privilege escalation to root and, in some cases, bypass isolation boundaries. The Canadian Centre for Cyber Security warned that the impact becomes more severe when the bug is chained with a remote code execution vulnerability, and urged organizations to identify exposed systems, apply vendor fixes, reboot after kernel updates, restrict access, enforce kernel security controls, monitor logs, and segment high-risk or Internet-facing workloads.

Vendor and community activity indicates broad exposure across modern Linux platforms. Red Hat lists RHEL 8, RHEL 9, RHEL 10, and corresponding kernel-rt packages as affected, while RHEL 6 and RHEL 7 are marked not affected because the vulnerable code is absent. Public exploit interest accelerated after Theori published the "Copy Fail" technical write-up and proof-of-concept repository, which references testing on Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16; Rocky Linux also published related errata, signaling downstream patch availability in enterprise Linux ecosystems.