I’m an heavy container user, and deployed several containers through container station. Since this new vulnerability will break the security in container environment, does QUTS/QTS been affected by this vulnerability If so, does QNAP planning to fix this on the mainstream QTS 5.2/QUTS 5.2/QUTS 5.3/…

Hi @Sam25 , Thank you for bringing this topic to our attention. QNAP takes information security seriously. For CVE-2026-31431 / “Copy Fail,” QNAP has published an official security advisory here: https://www.qnap.com/en/security-advisory/qsa-26-16 The advisory provides official information, incl…

It depends on your risk tolerance. Just because an exploit is available does not mean that someone will take advantage of that exploit on your machine. If you are concerned about the risk, I would take all internet exposed containers off the internet. If your NAS is entirely behind your firewall,…

Just been testing my devices here with this PoC: GitHub - rootsecdev/cve_2026_31431: Exploit POC for CVE_2026_31431 · GitHub I can confirm the info in the security advisory: the only QNAP NAS affected by this issue has an ARM64 CPU (TS-216G running QTS 5.2.9.3451). [/share/Public] # python3 test_c…

I found it very interesting that only QNAP Arm models are affected. The x86 models must be using a different kernel. In fact, wasn’t someone complaining not long ago that their QNAP was running an “old” Linux kernel? :smiley:

[image] NA9D: The x86 models must be using a different kernel. I think this particular vulnerability depends on the capabilities of the kernel, as-set at compile time. I guess QNAP compile the aarch64 kernel with options different to the other NAS arches. But I could be wrong. I’m not a kern…

From design the ARM and x86_64 must be different kernel. And one thing is the ARM models rely on the toolchain from SoC vendors, and might based on the Linux by SoC vendor instead of generic Arch in x86. We still have access to all the kernel codes, but while it work we will not change everything. …

A user in the German forum speculates that QNAP has not compiled a certain module into the x86 NAS kernel versions [image] QSA-26-16 Local Privilege Escalation Vulnerability in Linux Kernel (Copy... Es gibt eine zusätzliche Info von QNAP zur Sicherheitsmeldung. Anmerkung: Betrifft nur…

[image] Linux 7.2 Proceeding To Deprecate AF_ALG Due To "Massive Attack Surface",... The Linux kernel's AF_ALG interface for user-space applications to directly access the Linux kernel's built-in cryptographic engine is proceeding with a quick deprecation cycle due to a 'massive attack …

Follow-up: checked the newly released QTS 5.2.10.3568 for this vulnerability on my ARM64 NAS: [/share/Public] # python3 test_cve_2026_31431.py; echo $? [*] CVE-2026-31431 detector kernel=5.10.60-qnap arch=aarch64 [i] Kernel 5.10.60-qnap predates the affected 6.12/6.17/6.18 lines; trigger may not …

Regarding the new CVE-2026-31431 (copy fail) vulnerability on QNAP NAS

English Container & Virtualization

OneCD June 1, 2026, 4:45pm 9