What's the status of Copy Fail in the CircleCI infrastructure?

[joshbressers]

Can someone let us know what the status of the Copy Fail vulnerability is in the CircleCI environment? Has it been patched or mitigated?

Copy Fail — 732 Bytes to Root

[joshbressers]

I see a response here

CircleCI response to CVE-2026-31431 ("Copy Fail" Linux kernel vulnerability)

On April 29, 2026, Linux kernel vulnerability CVE-2026-31431 was disclosed that could allow a user already running code on a system to gain elevated access. CVE-2026-31431 is a logic bug in the Linux kernel’s algif_aead crypto submodule - the part of the kernel that handles certain cryptographic operations. The bug lets an unprivileged user (one without admin rights) write a small amount of controlled data into kernel memory, which can then be leveraged to gain root access on that same machine.…

That’s a great response, thanks!