page_inject

pageinject - AFALG aead cross-container escape AFALG aead vulnerability cross-container exploit -- pivot from one compromised container into every sibling container that shares the samelibc.so.6 image layer. This is an escape primitive : it runs from inside an unprivileged container that the...

Copy-Fail-CVE-2026-31431-Kubernetes-PoC

Copy Fail CVE-2026-31431 — Kubernetes Container Escape PoC A proof-of-concept demonstrating how a fully unprivileged container can achieve node-level code execution on Kubernetes by exploiting the CVE-2026-31431 Linux kernel page-cache corruption bug through shared container image layers. The cor...

CVE-2025-39964

Linux afalg concurrent-write race — patch-status tracking site Source for the CVE-2025-39964 patch-status tracker: a single-page site recording which distributions have shipped a fix for a race condition in the Linux kernel's AFALG cryptographic socket API, exploitable by a local user for kernel...

cve-2026-31431-checker

CVE-2026-31431 "Copy Fail" — Vulnerability Detection Script Shell-based scanner for CVE-2026-31431 "Copy Fail" , a local privilege escalation vulnerability in the Linux kernel's cryptographic subsystem algifaead / AFALG interface. An unprivileged local user can write 4 bytes into the in-memory pa...

CopyFail-CVE-2026-31431

CopyFail: CVE-2026-31431 Python implementation of copy.fail. Overwrites the page cache of a setuid-root binary via AFALG + splice to get root. No race, no offsets works on any Linux distro since 2017. Requirements Python 3.6+ 3.12+ uses os.splice natively; older versions fall back to ctypes Linux...

copyfail

Copy Fail CVE-2026-31431 – Exploit Usage Guide Original Readme taken from @painoob All Kernel versions since 2017 / 2016 are vulnerable ! Kernel 7 is fully immune, others between 5-7 may still be vulnerable ⚠️ Disclaimer This content is for educational and authorized security testing purposes only...

CVE-2026-31431_SCA_WAZUH

Wazuh SCA policy: Copy Fail CVE-2026-31431 This policy file: copy-fail-cve-2026-31431-policy.yml is designed to detect likely exposure and mitigation status for Copy Fail / CVE-2026-31431. What this policy checks 1. algifaead is disabled via modprobe policy. 2. algifaead is not currently loaded. ...

Copy-Fail-CVE-2026-31431-Kubernetes-PoC

Copy Fail CVE-2026-31431 — Kubernetes Container Escape PoC A proof-of-concept demonstrating how a fully unprivileged container can achieve node-level code execution on Kubernetes by exploiting the CVE-2026-31431 Linux kernel page-cache corruption bug through shared container image layers...

CVE-2026-31431-Checker-Mitigator

CVE-2026-31431 Checker & Mitigator A simple, safe vulnerability scanner and mitigation tool for CVE-2026-31431 aka "Copy Fail", a local privilege escalation vulnerability in the Linux kernel's AFALG cryptographic interface. Note - It is fully vibe coded Script About the Vulnerability CVE :...

copyfail-exploit

Copy Fail · CVE-2026-31431 Local privilege escalation on Linux kernels from 4.11 up to but not including the patched 6.18 releases. The bug lives in the kernel's AFALG socket interface—specifically how authencesn handles scatter-gather lists during in‑place AEAD decryption. The result: an...

CVE-2026-31431

Copy Fail - CVE-2026-31431 This repository contains a small Linux local privilege escalation PoC for CVE-2026-31431, also known as "Copy Fail". The exploit targets the Linux kernel algifaead path in the AFALG userspace crypto API. It uses AFALG plus splice to coerce the kernel into writing into t...

copy-fail

CopyFail Mitigation CVE-2026-31431 - Multi-Distribution Guide This repository contains detailed tutorials and scripts to mitigate the CopyFail vulnerability CVE-2026-31431. This flaw affects the Linux Kernel cryptography subsystem AFALG and allows local privilege escalation LPE from a regular use...

copy-fail-mitigation-with-bpftrace

copy-fail-mitigation-with-bpftrace CVE-2026-31431, AKA Copy Fail, can be mitigated in one-line with bpftrace, no kpatch building, no cargo building English Version | 中文版本 Idea To exploit Copy Fail, you need to bind socket AFALG and use algorithm authencesn , which most applications don't use a lo...

cve-2026-31431

CVE-2026-31431 This document describes a public Python exploit related to the CVE-2026-31431 vulnerability. The code demonstrates the exploitation of the flaw using primitives from the Linux AFALG subsystem, AEAD cryptographic operations, and memory manipulation via splice, with the goal of...

CVE-2026-31431

🔐 CVE-2026-31431 - Kernel Exploitation Research Framework Modular framework for studying a Linux privilege escalation LPE vulnerability based on AFALG + Page Cache Injection techniques. 🎯 Objective This project is designed for: Research of Linux kernel vulnerabilities Teaching real exploitation...

alg_check

⚠️ Important Disclaimer: Structural Hardening Risks This tool implements Structural Blocking to mitigate CVE-2026-31431 by physically renaming kernel modules and purging them from memory. Before use, please be aware of the following architectural risks: Kernel Update Volatility : Hardening effects...

CVE-2026-31431

AFALG su memory‑patch exploit research A compact Python script that exploits an AFALG‑related kernel vulnerability to patch the su binary in memory and escalate privileges. This is provided for educational and research purposes only. ⚠️ Do not use this on any system you do not own or without...

block-copyfail

Summary CVE-2026-31431 "Copy Fail" is a Linux kernel privilege escalation vulnerability in the algifaead cryptographic interface. An attacker uses AFALG sockets with the authencesn algorithm and splice to corrupt arbitrary files in the kernel page cache — including setuid binaries like /usr/bin/s...

copy-fail-CVE-2026-31431-mitigation-ansible-playbook

CVE-2026-31431 Mitigation Playbook An Ansible playbook to apply and rollback the CVE-2026-31431 AFALG kernel module mitigation on both Debian/Ubuntu and RHEL/Rocky/AlmaLinux systems. Overview This playbook mitigates CVE-2026-31431 by disabling the vulnerable algifaead kernel module: Debian/Ubuntu...

CVE-2026-31431-mitigation-suite

AFALG Defense Framework A kernel-runtime defense framework for the Linux AFALG Address Family Algorithm, family 38 subsystem. Built for Security Operations Centers running enterprise Linux fleets where Zero Trust must extend into the kernel, not stop at the network edge. Why AFALG matters to a SO...