CISA flags actively exploited ‘Copy Fail’ Linux kernel flaw enabling root takeover across major distros — unpatched systems may remain vulnerable to attack

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified a critical Linux kernel vulnerability named "Copy Fail" that is actively being exploited, allowing attackers to gain root access on major Linux distributions like Ubuntu and Red Hat. The flaw, disclosed by security researchers at Theori, enables privilege escalation for local users and has a 100% reliable proof-of-concept exploit. The vulnerability was publicly disclosed without prior coordination with Linux distribution maintainers, leading to a compressed response time for deploying patches. CISA has issued a directive for federal agencies to patch affected systems promptly, while Linux vendors are releasing updates to address the issue. Users are advised to update their systems to protect against potential attacks.