Research

Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild

This research analyzes the Linux kernel privilege escalation vulnerabilities Copy Fail and DirtyFrag, which exploit subtle page cache corruption bugs to create reliable paths to root access. Additionally, Elastic Security Labs is releasing detection logic for these vulnerabilities.

Read at Elastic Security Labs

Vendor

Linux kernel, Elastic

Product

Linux kernel, Elasticsearch / Kibana

Exposure class

Operating system, Database

• Elastic Security Labs (elastic.co)
• CVE-2026-31431 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 26
   CISA advisory CISA 22 Sep 2026

   Siemens SIPLUS and SIMATIC Products

   CVSS 3.1 Fix available CVE-2026-31431 Siemens
2. 32
   CISA advisory CISA 17 Sep 2026

   ABB Ability Edgenius

   CVSS 3.1 Fix available CVE-2026-31431 Linux kernel ABB
3. 34
   Research Elastic Security Labs 11 Sep 2026

   Linux Detection Engineering - Local Privilege Escalation

   PoC public EPSS 0.16 CVE-2026-64600CVE-2026-31431CVE-2026-43284+8 more
4. 32
   CISA advisory CISA 14 Jul 2026

   ABB Ability Edgenius

   CVSS 3.1 Fix available CVE-2026-31431 Linux kernel ABB
5. 51
   CISA advisory CISA 23 Jun 2026

   Impact of Linux Kernel vulnerabilities on B&R products

   PoC public CVSS 3.1 EPSS 0.16 CVE-2026-31431CVE-2026-43284CVE-2026-46333+2 more Linux kernel ABB
6. 33
   Research Datadog Security Labs 28 May 2026

   From Exploit Code to Production Detection: Building a CVE-2026-31431 (Copy Fail) detection with Agents

   PoC public CVE-2026-31431 Datadog
7. 24
   Advisory Fortinet PSIRT 13 May 2026

   Linux Kernel Vulnerability copy.fail - CVE-2026-31431

   CVSS 3.0 Fix available CVE-2026-31431 Fortinet Linux kernel
8. 25
   Wiz Research Wiz 1 May 2026

   Copy Fail: Universal Linux Local Privilege Escalation Vulnerability

   CVE-2026-31431 Linux kernel