CVE-2026-31431: Linux kernel

1. A public proof of concept: reached 2026-04-30

• Pulse's own check
  NVD lists references tagged "Exploit" (listed, not fetched)
  capture pulse: raw/us/registry/nvd/cve-2026-31431/20261023T131240Z/text.txt, 23 October 2026, 13:12 UTC, sha256 2b8f63c69b5d0eb9 original
• CERT-EU (advisory 2026-005, Thursday, April 30, 2026) reached, 2026-04-30

  third-party text, as Pulse recorded it
  On 29 April 2026, a high local privilege escalation vulnerability in the Linux kernel, tracked as CVE-2026-31431 and named "Copy Fail", was publicly disclosed. ... A public proof-of-concept exploit has been released.

  Pulse: An EU CERT stating a public PoC exists.
  capture watch:oq9gflln: raw/eu/cert/cert-eu/security-advisories/20261022T150854Z/text.txt, 22 October 2026, 15:08 UTC, sha256 3bb126bc5e578028 original

2. A nuclei template that exploits rather than only fingerprints: not reached

3. A merged Metasploit module: reached

• Pulse's own check
  In the Metasploit module index (master)
  capture pulse: raw/us/weaponisation/metasploit/modules-metadata/20261022T221133Z/text.txt, 22 October 2026, 22:11 UTC, sha256 2f68e2134c3c0104 original

4. Exploitation attempts reported by a named party: not reached

5. A KEV listing (the date added): reached 2026-05-01

• Pulse's own check 2026-05-01
  KEV catalog 2026.10.21
  capture pulse: raw/us/registry/cisa-kev/kev-json/20261022T221059Z/text.txt, 22 October 2026, 22:10 UTC, sha256 97336b5231c74981 original

6. knownRansomwareCampaignUse: Known on KEV: not reached

7. A national CERT reporting compromises in its country: not reached

8. A named organisation saying it was compromised through that flaw: not reached

a victim's own statement is recorded by hand from a capture; none recorded