Threat actors have started to exploit Copy Fail (CVE-2026-31431), a Linux kernel vulnerability leading to root shell access.