CVE-2026-31431-mitigacion

CVE-2026-31431 — Complete Technical Analysis Classification: Local Privilege Escalation LPE — Linux Kernel CVSS: 7.8 High Impact: unprivileged user → root Affected module: algifaead AFALG kernel subsystem Table of Contents 1. Why is it vulnerable? 2. Which versions are affected? 3. How it is...

deny-af-alg-bpf

deny-af-alg-bpf Description BPF LSM program that blocks AFALG Linux kernel crypto API socket creation and logs all attempts via a ring buffer to userspace. What it does Attaches to the lsm/socketcreate hook Denies any socketAFALG, ... call with -EPERM Emits structured events pid, comm to a BPF ri...

Linux-CopyFail-C-Version-CVE-2026-31431

Linux CopyFail- C Version - CVE-2026-31431 Clean C version of Copy Fail CVE-2026-31431 - Linux Local Privilege Escalation exploit using AFALG + authencesn + splice primitive. Overwrites the page cache of /usr/bin/su with a tiny setuid shellcode to gain root privileges. Educational proof-of-concep...

cve-2026-31431-ansible

CVE-2026-31431（「Copy Fail」）— Ansible 緩和策レシピ CVE-2026-31431 （「Copy Fail」）に対するカーネルコマンドラインの緩和策を、Ansible を使用して Debian / Ubuntu / RHEL 系のフリート全体で検出・適用します。 この CVE は、Linux カーネルの algifaead AFALG インターフェースにおけるローカル権限昇格の脆弱性です。www-data、mysql などのサービスアカウントや、RCE された Web アプリ内のプロセスを含む、権限のないローカルユーザーは、わずか数回の syscall ...

copy-fail-CVE-2026-31431

CVE-2026-31431 — Copy Fail Linux kernel local privilege escalation via AFALG + splice page-cache overwrite For authorized security research, penetration testing, and educational purposes only. Do not use against systems you do not own or have explicit written permission to test. Technical Writeup...

CVE-2026-31431

CVE-2026-31431: "Copy Fail" - Linux Kernel Local Privilege Escalation 📢 Disclaimer This repository is strictly for educational and cybersecurity research purposes. The exploit code is analyzed to understand the underlying vulnerability, facilitate patching, and develop defensive strategies. Do no...

cve-2026-31431

CVE-2026-31431 "Copy Fail" — IR Playbook & Detection Package Production-ready IR playbook, detection rules, and SOC triage guidance for CVE-2026-31431 — a Linux kernel local privilege escalation in the algifaead crypto interface. Includes an interactive HTML playbook , Sigma rules, auditd configs...

CVE-2026-31431

CVE-2026-31431 — From a NULL Pointer to Root: Exploiting AFALG AEAD in the Linux Kernel Bug class: Null pointer dereference → heap OOB write → credential overwrite Affected subsystem: net/alg/afalg.c Impact: Local Privilege Escalation unprivileged user → root Affected kernels: Linux 4.4 – 4.9...

CVE-2026-31431

CVE-2026-31431 "Copy Faill" CVE-2026-31431 Archive and Analysis. Source code for attack Testing Sniffing Tools for the potential Vulnerability. Solution root@kitploit: 禁用内核模块 echo "install algifaead /bin/false" /etc/modprobe.d/disable-algif-aead.conf 卸载已加载模块 rmmod algifaead 2/dev/null...

check-copyfail-cve-2026-31431

check-copyfail check-copyfail.sh は、CVE-2026-31431（「Copy Fail」）に対するホストの曝露度を評価する読み取り専用の Bash スクリプトです。 作者: Silent4Labs このスクリプトはローカルシステムの以下を検査します: カーネルバージョンと既知の上流パッチ適用状況 影響を受けるディストリビューションのベースライン algifaead モジュールの状態 アクティブな AFALG ソケットの使用状況 authencesn の利用可否 /usr/bin/su などの一般的な読み取り可能な setuid-root ターゲット...

copy_fail

Copy Fail — CVE-2026-31431 CVE-2026-31431 Copy Fail is a local privilege escalation vulnerability in the Linux kernel's algifaead module AFALG subsystem. A logic flaw introduced in August 2017 allows any unprivileged local user to write 4 controlled bytes into the page cache of any readable file...

Copy-Fail---CVE-2026-31431

Copy-Fail---CVE-2026-31431 CVE-2026-31431 "Copy Fail" - Analysis and defensive research for the Linux kernel AFALG privilege escalation vulnerability affecting all major distributions since 2017. 100% reliable LPE via authencesn logic flaw Files include a binary , that automates the whole process...

cve-2026-31431

CVE-2026-31431 "Copy Fail" — Detection & Safe Kernel Patch Scripts Linux kernel local privilege escalation via algifaead AFALG CVSS 7.8 HIGH | Public disclosure: April 2026 ⚡ Quick Start 1. Detection Script safe, read-only Run as a normal user: root@kitploit: curl -fsSL...

CVE-2026-31431-CopyFail-static-ELF--POC

CVE-2026-31431: Copy Fail - 587-byte static ELF I did not find this bug. Credit goes to Xint Code / Theori. This repo is my take on making the exploit as small as possible - a hand-rolled x8664 ELF that does the full LPE in 587 bytes. No libc, no linker, no runtime. Just NASM and stubbornness. In...

Copy-fail-CVE-2026-31431-Exploit-in-C

Copy-fail-CVE-2026-31431-Exploit-in-C Discovery and original disclosure of CVE-2026-31431: Theori / Xint. Public writeup: https://copy.fail/. Overview This program targets the Linux kernel’s AFALG AEAD path and attempts to trigger the “Copy Fail” page-cache corruption behavior described in public...

RK35xx-CopyFail-Hotfix

RK35xx Kernel Patch: CVE-2026-31431 "Copy Fail" RK35xx CopyFail Hotfix: CVE-2026-31431 Patch for Joshua Riek's Ubuntu 24.04 A community-provided, pre-compiled kernel patch for all RK35xx single-board computers Rock 5, Orange Pi 5, NanoPC, etc. running Joshua Riek's Ubuntu 24.04 Kernel...

CVE-2026-31431-copyfail-rs

CVE-2026-31431 CopyFail CVE-2026-31431 POC. Pure Rust implementation, no runtime dependencies. Applicable Targets Linux x8664 kernels with CONFIGCRYPTOUSERAPIAEAD=y AFALG AEAD support enabled and the algifaead module loadable. Usage root@kitploit: ./CVE-2026-31431-copyfail-rs Dependencies Build...

CVE-2026-31431-PocC

CVE-2026-31431-PoC CVE-2026-31431 PoC reproduced in C, usable for exploitation when Python is not available on the target environment. Vulnerability Basic Information Vulnerability type: Linux kernel AFALG subsystem page cache poisoning, achieving local privilege escalation and possible container...

CopyFail-for-dummies

Copy Fail / CVE-2026-31431 — Research Notes Overview This repository contains a cleaned-up technical diagram and supporting notes for the Linux kernel vulnerability commonly referred to as Copy Fail and tracked as CVE-2026-31431. The purpose of this material is: to explain the bug mechanism at a...

copy-fail-cve-2026-31431

Copy Fail - CVE-2026-31431 This repository provides a Go port of the public Copy Fail PoC and a reproducible build pipeline for multi architecture Linux binaries. Copy Fail CVE-2026-31431 is a Linux kernel logic flaw in authencesn that enables a deterministic 4 byte write into page cache data...