Linode incident: (Copy Fail) Linux Kernel Local Privilege Escalation Vulnerability [CVE-2026-31431]

Affected components

• AP-Northeast (Tokyo 2) Linode Kubernetes Engine
• AP-Northeast-2 (Tokyo 2)
• AP-Northeast-2 (Tokyo 2) Backups
• AP-Northeast-2 (Tokyo 2) Block Storage
• AP-Northeast-2 (Tokyo 2) NodeBalancers
• AP-South (Singapore)
• AP-South (Singapore) Backups
• AP-South (Singapore) Block Storage
• AP-South (Singapore) Linode Kubernetes Engine
• AP-South (Singapore) NodeBalancers
• AP-South (Singapore) Object Storage
• AP-Southeast (Sydney)
• AP-Southeast (Sydney) Backups
• AP-Southeast (Sydney) Block Storage
• AP-Southeast (Sydney) Linode Kubernetes Engine
• AP-Southeast (Sydney) NodeBalancers
• AP-West (Mumbai)
• AP-West (Mumbai) Backups
• AP-West (Mumbai) Block Storage
• AP-West (Mumbai) Linode Kubernetes Engine
• AP-West (Mumbai) NodeBalancers
• AU-MEL (Melbourne)
• AU-MEL (Melbourne) Backups
• AU-MEL (Melbourne) Block Storage
• AU-MEL (Melbourne) Linode Kubernetes Engine

1. resolvedMay 5, 2026, 22:19 UTC

   We have completed our investigation and response to the “Copy Fail” Linux kernel local privilege escalation vulnerability (CVE-2026-31431). We have published a documentation article with detailed guidance on available mitigations and recommended actions for affected systems. Customers can find more information and step-by-step instructions here: https://www.linode.com/docs/guides/cve-2026-31431-copy-fail-mitigation/ We encourage all customers to review the article and apply the appropriate mitigations to their environments. If you have questions or need assistance, please contact us at 855-454-6633 (+1-609-380-7100 Intl.) or email [email protected] for assistance.

2. investigatingMay 1, 2026, 17:52 UTC

   We are continuing to investigate this issue.

3. investigatingMay 1, 2026, 17:51 UTC

   Akamai is aware of the recently disclosed “Copy Fail” vulnerability (CVE-2026-31431). We are assessing the issue and are working to address it across our product portfolio and internal systems. While we have not observed any related malicious exploits targeting our infrastructure, Akamai continuously works to reduce risks and enhance our security posture. We are taking both immediate and longer-term steps to mitigate potential impacts and help ensure the continued confidence of our customers. Per our Shared Security Model[1], customers are responsible for making sure their service’s installed applications and code are securely configured and patched. Given the nature of this vulnerability, it should be assumed that all virtual machines running Linux are at-risk until patched. We will be publishing more details as patches are incorporated into the base images that we supply, but we strongly recommend customers deploy mitigations on all instances. Furthermore, the nature of the vulnera

What APIStatus.watch saw

Our 5-minute checks didn't record a change in Linode's overall status around this incident. Smaller or regional incidents often leave a provider's overall status green.

Other services with incidents at the same time

Overlapping incidents aren't necessarily related.

• 1Password: SaaS Manager workflows and integrations are failingCritical · May 4, 2026, 17:59 UTC
• Netlify: Agent Runner failures on new projectsCritical · May 5, 2026, 20:53 UTC
• Discord: Message Sends affected on certain channelsMajor · May 2, 2026, 17:03 UTC
• GitBook: 500 errors on some *.gitbook.io published sitesMajor · May 4, 2026, 11:55 UTC
• Contentful: Some customers are experiencing issues logging inMajor · May 4, 2026, 13:20 UTC
• Miro: Miro is partially downMajor · May 4, 2026, 16:23 UTC
• Snyk: Snyk recurring tests showing slow performanceMinor · Apr 21, 2026, 18:58 UTC
• Akamai: Intermittent Edge Delivery Delays in Chennai, IN (MAA) RegionMinor · Apr 28, 2026, 16:42 UTC
• Akamai: Reporting Issues affecting URL Traffic and URL Responses reportsMinor · Apr 29, 2026, 05:19 UTC
• Intercom: Investigating: Compromised version of intercom-client npm package and intercom-phpMinor · Apr 30, 2026, 16:58 UTC

How often does Linode have incidents?

Linode reported 10 incidents in the last 90 days. A typical incident lasted 2h 15m. See Linode's uptime and incident history