Linux kernel flaws put crypto exchanges, validators, and custody systems on alert

Security researchers are currently reacting to two Linux kernel vulnerabilities, which are forcing crypto infrastructure operators into urgent security reviews.

On April 29, researchers publicly disclosed a critical local privilege escalation flaw dubbed CVE-2026-31431 or “Copy Fail” in the Linux kernel’s crypto API. Copy Fail reportedly affects every distribution made from 2017.

Copy Fail was confirmed active and immediately added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog on May 1.

Less than two weeks later, even before many organizations completed mitigation work for Copy Fail, another Linux privilege escalation chain called “Dirty Frag” hit the wild.

Dirty Frag was publicly disclosed on May 7. It reportedly combines CVE-2026-43284 and CVE-2026-43500 to obtain root privileges through Linux kernel memory-management flaws.

Researchers report that Dirty Frag can manipulate memory allocation patterns to overwrite privileged kernel objects and eventually gain root-level execution.

Unlike Copy Fail, Dirty Frag had no available patches at the time of disclosure.

Why crypto firms are particularly exposed to the Linux vulnerabilities

The crypto space is exposed to the Copy Fail and Dirty Frag vulnerabilities, as most core crypto infrastructure runs on Linux. 

Crypto exchanges use Linux servers to manage wallets and execute trades. Some of the cn-chain validators on PoS blockchains, like Ethereum and Solana, usually operate on Linux-based environments. The same goes for crypto custodians.

Due to this, researchers view Copy Fail and Dirty Frag as a risk to crypto platforms. 

Copy Fail already has patches available. However, deploying kernel updates across live crypto infrastructure is rarely simple. Dirty Frag presents the biggest risk, given that there are currently no official patches to deploy.

At the time of writing, no major crypto exchange or custody provider has publicly disclosed a breach tied to either vulnerability.

Both Copy Fail and Dirty Frag are currently featured on the latest alert list of the Canadian Cyber Centre. In one of the reports, the Cyber Center recommends that organizations concerned should disable vulnerable kernel modules until vendor patches are available. 

It also recommended restricting local and remote access to affected systems, particularly in shared or multi-tenant environments. “Monitor authentication, system, and kernel logs for signs of privilege escalation or abnormal activity,” the Cyber Center adds, among other safety measures.