Microsoft disclosed a high-severity vulnerability in the Linux kernel on May 1, 2026, that directly threatens Windows Subsystem for Linux 2 installations. Cataloged as CVE-2026-31431 and dubbed "Copy Fail," the flaw enables any unprivileged local attacker to escalate to root inside a WSL2 environment. An exploit already surfaced on April 30, targeting WSL 2.6.3 running kernel 6.6.87.2-microsoft-standard-WSL2 with Ubuntu 24.04.

What the Vulnerability Actually Is

The bug lives in the Linux kernel’s AF_ALG AEAD (Authenticated Encryption with Associated Data) subsystem, which handles cryptographic operations. An attacker with code execution capabilities — even as a standard user — can manipulate a memory handling flaw to gain full administrative control over the Linux instance. In WSL2, this means total compromise of the Linux filesystem, processes, and any sensitive data accessible from that environment.

Microsoft confirmed the vulnerability is not merely theoretical. The GitHub report from April 30 demonstrated successful exploitation in a real-world WSL2 setup, proving that the custom Microsoft-compiled kernel inherits the upstream bug. The affected kernel string, 6.6.87.2-microsoft-standard-WSL2, is a telltale sign, but administrators should assume any unpatched WSL2 kernel remains at risk until a specific fix is released.

What It Means for You

For everyday developers and power users running WSL2 on Windows 10 or 11, the risk depends on what code you’re executing inside Linux. If you regularly download and run third-party scripts, build untrusted repositories, or test software from the internet, an attacker could exploit this flaw to take over your Linux environment. Root access inside WSL2 does not directly compromise the Windows host, but it can steal source code, manipulate development tools, or pivot to network-accessible resources.

Enterprise administrators face a more complex problem. WSL2 often flies under the radar of endpoint security checks because it isn’t managed like a traditional Windows application. This vulnerability exposes a gap: many organizations don’t know how to patch WSL2 or even how many installations exist. The fix isn’t delivered through Windows Update for all users; instead, it depends on how WSL was installed.

How We Got Here

WSL2’s servicing model has evolved significantly. Originally, WSL shipped as an inbox Windows component, and kernel updates were bundled with Windows OS patches. In 2022, Microsoft moved WSL to a Store-serviced model, decoupling it from the Windows release cycle. This allowed faster kernel updates independent of Patch Tuesday. However, it also introduced multiple update channels that enterprises must manage separately:

  • Store-serviced WSL: The modern default on Windows 11 and updated Windows 10 systems. Updates come through the Microsoft Store, bypassing Windows Update entirely.
  • Inbox WSL: Legacy installations that receive kernel fixes only as part of cumulative OS updates. This channel is slower and tied to the Windows servicing schedule.
  • Web-download WSL: Users who install WSL via the wsl --install --web-download command or download the MSI bundle get a one-time version that doesn’t auto-update. They must manually repeat the web download for each new release.

This fragmentation means a single Windows device can be running a vulnerable WSL2 kernel even if the OS is fully up to date. The April 30 exploit report underscores the real-world impact: an attacker doesn’t need a network exploitable bug — just a way to run code in your Linux environment.

What to Do Now

Check Your WSL Version and Kernel

Immediately identify what you’re running. Open PowerShell or Command Prompt and run:

wsl --version

This prints the WSL package version. For Store-serviced installations, you’ll see a version number like 2.2.4.0 or similar; outdated versions may be older. Older inbox installations might not support this command, indicating you’re on the legacy update path.

Next, check the kernel string from inside any WSL2 distribution:

wsl uname -r

If the output resembles 6.6.87.2-microsoft-standard-WSL2, you are definitely vulnerable. But a different kernel version doesn’t guarantee safety — Microsoft hasn’t yet released a fixed version, so treat all current kernels as suspect until a patched release is announced.

Patch the WSL2 Kernel

For Store-serviced systems: Run wsl --update to fetch the latest WSL platform and kernel. If your organization blocks Store access, you’ll need to use an alternative route or temporarily enable the Store for the update.

For systems without Store access: Use wsl --update --web-download. This downloads the latest package directly from Microsoft servers. Repeat this step manually whenever a new kernel fix is published — it does not install future updates automatically.

For inbox WSL: Wait for a Windows cumulative update that includes the kernel fix. Microsoft has not yet confirmed when this will ship, but it will appear in Microsoft’s security update guide under CVE-2026-31431. In the interim, consider migrating to the Store-serviced model for faster future patches.

Update Linux Distribution Packages

The kernel fix alone isn’t enough. WSL2 distributions like Ubuntu or Debian run their own userspace packages, which may contain additional vulnerabilities. After patching the kernel, run your distribution’s package manager:

sudo apt update && sudo apt upgrade

This keeps your Linux environment current, but it won’t touch the Microsoft-provided kernel. Both layers need independent attention.

Enterprise Inventory and Remediation

Security teams should immediately:

  1. Inventory all endpoints with WSL2 enabled, using tools like wsl --list --verbose.
  2. Record the WSL package version, kernel version, and update channel (Store, inbox, web).
  3. Test the available update commands (--update or --update --web-download) to confirm the channel works across corporate network controls.
  4. Set a compliance deadline for all WSL2 instances to be verified on a patched kernel after Microsoft releases a fix.
  5. Decide on a fallback plan for machines that can’t be updated — for example, restricting WSL2 use to trusted code only or temporarily disabling the feature.

Microsoft’s documentation makes clear that Windows management tools don’t handle Linux distribution updates, so assign ownership of each layer: the Windows endpoint team for the WSL platform and kernel, and the Linux ops or developer experience team for distribution packages.

Outlook

Microsoft is working on a kernel patch for CVE-2026-31431, though no release date has been set. Once available, it will roll out through the Store servicing channel first, followed by a Windows cumulative update for inbox users and a web-download package. In the meantime, the confirmed exploit should push organizations to treat WSL2 as a critical security surface, not an optional developer tool.

Watch for Microsoft’s official advisory update and a new kernel version string from the WSL team. The next time a high-severity Linux bug surfaces, the difference between a smooth patch and a breach will depend entirely on how well your WSL update channel is configured — and verified.