ABB Ships Edgenius 3.2.4.1 to Close Copy Fail Kernel Bug
Default Edgenius installs carry no non-admin local users, so the local-execution prerequisite narrows the attack surface substantially, but operators running containerized workloads should treat this as a patch-now item.
TL;DR
ABB shipped Ability Edgenius 3.2.4.1 to close CVE-2026-31431 (Copy Fail), a Linux kernel vulnerability in the algif_aead cryptographic interface that lets a local authenticated user or compromised container workload escalate to root. Affected versions 3.2.0.0 through 3.2.4.0 run on Edgenius Gateways and Servers in critical manufacturing, energy, water, and chemical facilities. CVSS 7.8 reflects the post-exploitation impact, but ABB notes default installs carry no lower-privilege users and no active exploitation has been reported. The CISA advisory republishes ABB PSIRT 7PAA024620, first issued in July.
CVE-2026-31431 (nicknamed Copy Fail) sits in the Linux kernel's algif_aead interface, which handles authenticated encryption operations in userspace. The flaw was an incorrect in-place operation where source and destination data mappings diverged, creating a path for a local user to corrupt kernel memory and escalate to root. The bug traces back to 2017 and affects kernels used by most major distributions. For Edgenius deployments, that means any version from 3.2.0.0 through 3.2.4.0 running on ABB's gateway or server appliances is vulnerable. Once an attacker has root on the edge device bridging OT networks to control systems, the integrity and availability of the SCADA environment is in play.
The CVSS 7.8 score captures the severity of what happens after exploitation, but it doesn't account for the friction of getting there. Copy Fail requires local code execution, physical access to the appliance or valid SSH credentials, or a compromised process already running on the box. ABB's default Edgenius configuration ships with no non-admin local users, and the advisory explicitly lists limiting SSH and Cockpit access as a mitigating control. For the substantial majority of Edgenius appliances sitting in locked cabinets on segregated OT networks, the practical attack surface is narrow.
That math shifts in environments where Edgenius hosts containerized or multi-tenant workloads. If untrusted containers share the kernel with the Edgenius management stack, a compromised container supplies all the local execution Copy Fail needs. The advisory flags this explicitly: "in shared, containerized, or multi-tenant environments this may increase the security risk." Operators running application containers on their Edgenius appliances should treat this as a distinct threat vector, not as the same local-access bug mitigated by default configs.
ABB first published this advisory as PSIRT 7PAA024620 in July 2026. CISA's September republication doesn't add new technical findings, it surfaces the fix for operators who may have missed the original during summer maintenance freezes or who track advisories primarily through CISA's ICS feed. No active exploitation against Edgenius deployments has been reported, though the underlying kernel vulnerability has been publicly disclosed since early 2026.
The remediation is a version upgrade to Edgenius 3.2.4.1, which incorporates the upstream kernel fix. For operators running default configurations on isolated appliances with no added local users, the mitigating factors are real and this can follow a scheduled-maintenance cadence. For anyone running containerized workloads on Edgenius (or who has created local user accounts beyond the default admin) the patch belongs in the current change window.
Published ·Deep Fathom