A single 732-byte script grants root access to major Linux distributions, researchers say
The vulnerability, designated CVE-2026-31431, allows unprivileged users to compromise container boundaries and evade file-integrity tools using a minimal Python exploit.
Security researchers at Xint Code have uncovered a critical local privilege escalation vulnerability affecting a wide range of widely used enterprise and cloud operating systems. Designated CVE-2026-31431, the flaw enables attackers to gain root access on Ubuntu, Amazon Linux, Red Hat Enterprise Linux, and SUSE systems.
The discovery highlights a significant security gap that has existed since 2017, impacting systems for over a decade. The exploit is characterised by its extreme brevity, requiring only a single 732-byte Python script to execute. This minimal code footprint lowers the barrier for automated or manual attacks, making the vulnerability particularly dangerous for administrators managing large fleets of servers.
Technically, the attack mechanism is sophisticated enough to bypass page-cache write protections and evade on-disk file-integrity tools. Furthermore, the exploit successfully crosses container boundaries, allowing an unprivileged user within a container to compromise the host system. This capability undermines common isolation strategies relied upon in modern cloud and containerised environments.
The vulnerability was made public through a Hacker News feed and associated security reporting by Xint Code. The researchers noted that the exploit operates as a straight-line code path without relying on race conditions or per-distribution offsets. This universality across major Linux distributions since 2017 suggests a systemic issue rather than an isolated configuration error.
While the specific kernel versions or exact kernel configurations within the affected distributions are not detailed in the available source material, the scope of impact remains broad. The prevalence of unpatched systems across the affected distributions since 2017 is unknown, but the long duration since the vulnerability was introduced suggests a significant window for potential exploitation.
Organisations relying on these operating systems must urgently review their patching procedures and container security postures. The effectiveness of the exploit in production environments with additional hardening measures beyond standard configurations remains unverified, yet the ability to bypass fundamental protections warrants immediate attention from security teams.
