copyfail-exploit

Copy Fail · CVE-2026-31431 Escalatazione locale dei privilegi sui kernel Linux dalla versione 4.11 fino alle release 6.18 corrette escluse. Il bug risiede nell'interfaccia socket AFALG del kernel—in particolare nel modo in cui authencesn gestisce le liste scatter-gather durante la decrittazione...

CVE-2026-31431

CVE-2026-31431 — Copy Fail Local Privilege Escalation in the Linux kernel's authencesn cryptographic template via AFALG + splice. Disclosed April 29, 2026 by Theori Xint Code. Overview Field| Detail ---|--- CVE| CVE-2026-31431 Nickname| Copy Fail CVSS| 7.8 HIGH Type| Local Privilege Escalation LP...

CVE-2026-31431

Copy Fail - CVE-2026-31431 This repository contains a small Linux local privilege escalation PoC for CVE-2026-31431, also known as "Copy Fail". The exploit targets the Linux kernel algifaead path in the AFALG userspace crypto API. It uses AFALG plus splice to coerce the kernel into writing into t...

copy-fail

CopyFail Mitigation CVE-2026-31431 - Multi-Distribution Guide This repository contains detailed tutorials and scripts to mitigate the CopyFail vulnerability CVE-2026-31431. This flaw affects the Linux Kernel cryptography subsystem AFALG and allows local privilege escalation LPE from a regular use...

CVE-2026-31431-Check

CVE-2026-31431 Copy Fail Vulnerability Check Script Vulnerability Overview CVE-2026-31431 Copy Fail is a Linux kernel local privilege escalation vulnerability that exploits AFALG sockets address family 38 combined with the splice zero-copy system call to bypass file write permissions and tamper...

Paranoid-Dirty-Frag-CVE-2026-43284

Dirty Frag mitigation script This script: 1. Blocks vulnerable kernel modules from loading 2. Unloads them if currently active 3. Verifies mitigation status WARNING: Disables Linux IPsec ESP support esp4/esp6 and RxRPC support. This may break: - strongSwan - libreswan - some enterprise VPNs -...

copyfail-arm64

Copy Fail ARM64 Research CVE-2026-31431 Analysis and ARM64 reproduction of the Copy Fail Linux kernel privilege escalation vulnerability CVE-2026-31431, originally disclosed by Xint. Blog post: Copy Fail on ARM64: Understanding and Porting CVE-2026-31431 What's Included File| Description ---|---...

CVE-2026-31431-Copy-Fail

CVE-2026-31431 — "Copy Fail": Linux Kernel algifaead Local Privilege Escalation CISA KEV | CVSS 7.8 HIGH | Affects Linux kernels 4.14 – early 2026 9 years Table of Contents 1. Executive Summary 2. Risk Assessment 3. Technical Deep Dive 4. Attack Methodology — Red Team 5. Detection & Incident...

cve-2026-31431-checker

CVE-2026-31431 Copy Fail Detection Tool A comprehensive detection and analysis tool for CVE-2026-31431 "Copy Fail" vulnerability in Linux kernels. ⚠️ IMPORTANT DISCLAIMER This tool is for DETECTION ONLY. It does not exploit or modify any system files. Only reads system information and configuratio...

cve-checker-2026

CVE Checker 2026 Multi-OS vulnerability scanner for: CVE-2026-31431 — Linux kernel crypto/algifaead flaw CVE-2026-41940 — cPanel & WHM authentication bypass CVSS 9.8 Supported Operating Systems Family| Distributions ---|--- Debian| Ubuntu, Debian, Linux Mint, Pop!OS RHEL| RHEL, CentOS, AlmaLinux,...

copy-fail-CVE-2026-31431

CVE-2026-31431 Copy Fail exploit Author: pyroceper Tested on: Ubuntu 25.10 x8664 $ make $ ./exploit Detected kernel: 6.17.0 Making backup of /etc/passwd to /tmp Backup saved as /tmp/passwd.bak Obtaining root shell... id uid=0pwn gid=0root groups=0root whoami pwn CREDITS & REFERENCES: Original...

alg_check

⚠️ Important Disclaimer: Structural Hardening Risks This tool implements Structural Blocking to mitigate CVE-2026-31431 by physically renaming kernel modules and purging them from memory. Before use, please be aware of the following architectural risks: Kernel Update Volatility : Hardening effects...

CVE-2026-31431

AFALG su memory‑patch exploit research A compact Python script that exploits an AFALG‑related kernel vulnerability to patch the su binary in memory and escalate privileges. This is provided for educational and research purposes only. ⚠️ Do not use this on any system you do not own or without...

CVE-2026-31431

🔐 CVE-2026-31431 - Kernel Exploitation Research Framework Modular framework for studying a Linux privilege escalation LPE vulnerability based on AFALG + Page Cache Injection techniques. 🎯 Objective This project is designed for: Research of Linux kernel vulnerabilities Teaching real exploitation...

block-copyfail

Summary CVE-2026-31431 "Copy Fail" is a Linux kernel privilege escalation vulnerability in the algifaead cryptographic interface. An attacker uses AFALG sockets with the authencesn algorithm and splice to corrupt arbitrary files in the kernel page cache — including setuid binaries like /usr/bin/s...

Estudo-de-Caso-CVE-2026-31431-CopyFail

🐧 CVE-2026-31431 — CopyFail: Linux Kernel Privilege Escalation Complete Case Study — How it was discovered, how it works, how to test, how to replicate in a safe environment and how to fix the critical vulnerability that affects almost all Linux distributions since 2017. 🚨 Legal Notice / Disclaim...

ubuntu-cve-2026-31431-mitigation

Complete Guide to Updating the Kernel and kmod in Ubuntu to Fix Security Vulnerabilities CVE CVE-2026-31431 This vulnerability, also known as Copy Fail, is a logic bug in the Linux kernel that occurs in the AFALG / algifaead path. According to the discloser, an unprivileged local user can cause t...

cfDr

cfDr - Copy Fail Doctor C opy F ail D etection and R emediation An Ansible role and playbook suite for detecting and remediating CVE-2026-31431 Copy Fail, a critical local privilege escalation vulnerability in the Linux kernel's algifaead module. Repository 🔗 GitHub :...

CVE-2026-31431

CopyFail CVE-2026-31431 Overview CopyFail is a proof-of-concept exploit for CVE-2026-31431, targeting a memory corruption vulnerability in the Linux Kernel Crypto API AFALG. The exploit leverages the splice system call to perform unauthorized page-cache patching of the /usr/bin/su binary, enablin...

copyfail-mitigation

CVE-2026-31431 — Copy Fail Linux Kernelalgifaead Privilege Escalation / Memory Corruption Ansible-based audit and mitigation playbooks — ready to run in production Overview Copy Fail CVE-2026-31431 is a vulnerability in the Linux kernel's algifaead module — the userspace-facing AEAD interface of...