CVE-2026-31431-Copy-Fail

CVE-2026-31431: When the Copy Isn’t a Copy and the Failure Comes Too Late Artifacts and scripts for the CopyFail writeup. The deep-dive walkthrough: https://4xura.com/binex/kernel/copy-fail/ Layout proof-of-concept/ contains the primitive-only demos used in the writeup. exploit-scripts/ contains...

CopyFail-Scanner-CVE-2026-31431

CopyFail-Scanner-CVE-2026-31431 CopyFail-Scanner is a tool that identifies the CopyFile vulnerability CVE-2026-31431. Enumerates the system Assesses exposure to the vulnerability Indicates the status vulnerable/not vulnerable Suggests and, optionally, executes a secure update based on the distro...

cve-2026-31431-ftrace

cve-2026-31431 mitigation using ftrace The ebpf solutions around for mitigating cve-2026-31431 require lsm=bpf at boot time, which is usually not set by default. For OracleLinux this was enabled by default in UEKr7u3 and in UEKr8u1 after December 2025. To check whether or not you can use ebpf-lsm...

CVE-2026-31431

CVE-2026-31431 CopyFail standard binary Get all new CVE alert on https://exploitroom.com mail :: /Desktop/CVE-2026 » file exploit: ELF 64-bit LSB executable, x86-64, version 1 GNU/Linux, statically linked, BuildIDsha1=9454dbdde0ac2d1a8981c06db89f24a4753ec3b7, for GNU/Linux 3.2.0, not stripped...

CopyFail-Patcher

Patcher script for CVE-2026-31431 This repo provide script for the CopyFail vulnerability, for Debian/Ubuntu/RHEL/Fedora, didn't test on other distros but anyway... Just follow these : $ git clone https://github.com/mhdgning131/CopyFail-Patcher.git $ cd CopyFail-Patcher $ chmod +x patchcopyfail.s...

Estudo-de-Caso-CVE-2026-31431-CopyFail

🐧 CVE-2026-31431 — CopyFail: Linux Kernel Privilege Escalation Complete Case Study — How it was discovered, how it works, how to test, how to replicate in a safe environment and how to fix the critical vulnerability that affects almost all Linux distributions since 2017. 🚨 Legal Notice / Disclaim...

CVE-2026-31431

CopyFail CVE-2026-31431 implemented in Go, Have fun...

CopyFail-CVE-2026-31431

CopyFail: CVE-2026-31431 Python implementation of copy.fail. Overwrites the page cache of a setuid-root binary via AFALG + splice to get root. No race, no offsets works on any Linux distro since 2017. Requirements Python 3.6+ 3.12+ uses os.splice natively; older versions fall back to ctypes Linux...

CopyFail-CVE-2026-31431

Copy Fail - CVE-2026-31431 Compile gcc exp.c -o ./exp Usage ./exp...

copyfail-guard

copyfail-guard A zero-dependency Python CLI that checks whether a Linux host appears exposed to CVE-2026-31431 "Copy Fail" without running an exploit. It can also apply a conservative temporary mitigation when the affected component is loadable as a kernel module. Supports Debian/Ubuntu,...

copyfail-c

copyfail-c A minimal C reproduction for researching Copy Fail CVE-2026-31431. This repository contains a compact C implementation built around the Linux kernel AFALG interface for vulnerability research, behavior analysis, and controlled reproduction. Repository layout . ├── src/ C source ├── dis...

copyFail30

CopyFail for Python versions 3.10 Os did not contain splice before version 3.10. This version of copyFail uses ctypes to make the syscall between descriptors without a utilizing the splice wrapper. Works on both older and current versions of python3. Based on...

BigFix-CopyFail-AlmaLinux-Content

This repository does not have a README...

check-copyfail-cve-2026-31431

check-copyfail check-copyfail.sh is a read-only Bash script that assesses host exposure to CVE-2026-31431 "Copy Fail". Author: Silent4Labs It inspects the local system for: kernel version and known upstream patch state affected distribution baselines algifaead module status active AFALG socket...

copyfail-briefing

This repository does not have a README...

CopyFail-Experiment

Just an experiment to verify that the LLM can find this vuln and construct a working exploit. Usage gcc -o poc poc.c ./poc...

CVE-2026-31431-copyfail-rs

CVE-2026-31431 CopyFail CVE-2026-31431 POC. Pure Rust implementation, no runtime dependencies. Applicable Targets Linux x8664 kernels with CONFIGCRYPTOUSERAPIAEAD=y AFALG AEAD support enabled and the algifaead module loadable. Usage ./CVE-2026-31431-copyfail-rs Dependencies Build time : libc +...

ansible-mitigate-copyfail-dirtyfrag

Ansible playbook to mitigate CopyFail, DirtyFrag and Fragnesia vulnerabilities Mitigate CopyFail CVE-2026-31431, DirtyFrag CVE-2026-43284 and Fragnesia CVE-2026-46300 vulnerabilities in the Linux Kernel using a simple but effective Ansible playbook. Use this Ansible Playbook to run against your...

copyfail-deconstructed

copyfail-deconstructed Easy-to-understand version of CVE-2026-31431, a privilege escalation technique that allows anybody to become root. The original proof-of-concept is found here: https://github.com/theori-io/copy-fail-CVE-2026-31431, but is heavily compressed and minified so it can have as...

copyfail-guard

copyfail-guard Automated detection and mitigation tool for the vulnerability CVE-2026-31431 "Copy Fail", a local privilege escalation LPE in the algifaead module AFALG interface of the Linux kernel. ⚠️ Scope: this project is purely defensive. It does not contain, generate, or reference exploit...