CVE-2026-89487

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

CVE-2026-89487

CVE-2026-89487 affects the openvswitch subsystem in the Linux kernel. The bug resides in queue_userspace_packet(), whose error path calls skb_tx_error() on a packet that is still being forwarded through remaining flow actions. This call strips SKBFL_SHARED_FRAG from the live skb via skb_zcopy_cle...

cve-2026-31431

CVE-2026-31431 — Copy Fail: Linux Kernel LPE Research Lab Educational purposes only. Do NOT use on systems without explicit authorization. Índice Descripción de la vulnerabilidad Componentes afectados Cómo funciona Setup del lab Docker PoC — Demostración Mitigación Referencias Descripción de la...

PT-2026-90203

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb tx error a packet we are about to drop queue userspace packet borrows the packet skb -- it only copies it into a private netlink message user skb and does not own it; on return do execute actions keeps...

CVE-2026-31431-Copy-Fail-R-pertoire-de-Pr-vention

🔴 CVE-2026-31431 — Copy Fail Escalada de Privilegios Local en el Kernel de Linux LPE — Repositorio de Investigación Defensiva 📖 Presentación Copy Fail CVE-2026-31431 es una vulnerabilidad de tipo Escalada de Privilegios Local LPE que afecta al kernel de Linux mediante una corrupción controlada de...

DirtyFrag-for-dummies

Dirty Frag / CVE-2026-43284 — Notas de investigación Resumen Este repositorio contiene un diagrama técnico depurado y notas complementarias para la vulnerabilidad del kernel de Linux comúnmente conocida como Dirty Frag y rastreada para la ruta xfrm-ESP como CVE-2026-43284. El problema pertenece a...

CVE-2026-43284-dirtyfrag-detection

DirtyFrag CVE-2026-43284 PoC Validation and auditd Detection Scope: Linux Local Privilege Escalation LPE validation focused on the XFRM/ESP path associated with CVE-2026-43284. This repository contains an English report and evidence artifacts from a controlled laboratory validation of the public...

CVE-2026-31431_CopyFail_LinuxKernel_LPE

CVE-2026-31431 — Copy Fail Linux Kernel LPE Educational rewrite of the Theori/Xint proof-of-concept for CVE-2026-31431, a local privilege escalation vulnerability in the Linux kernel's algifaead crypto socket interface. Affects every mainline kernel from 4.14 July 2017 through 6.18.21, and the 6....

copyfail-exploit

Copy Fail · CVE-2026-31431 Escalada de privilegios local en kernels de Linux desde 4.11 hasta sin incluir las versiones parcheadas 6.18. El fallo reside en la interfaz de sockets AFALG del kernel, específicamente en cómo authencesn maneja las listas scatter-gather durante el descifrado AEAD...

copyfail-exploit

Copy Fail · CVE-2026-31431 Local privilege escalation on Linux kernels from 4.11 up to but not including the patched 6.18 releases. The bug lives in the kernel's AFALG socket interface—specifically how authencesn handles scatter-gather lists during in‑place AEAD decryption. The result: an...

CVE-2026-31431

Copy Fail - CVE-2026-31431 This repository contains a small Linux local privilege escalation PoC for CVE-2026-31431, also known as "Copy Fail". The exploit targets the Linux kernel algifaead path in the AFALG userspace crypto API. It uses AFALG plus splice to coerce the kernel into writing into t...

CVE-2026-31431

🔐 CVE-2026-31431 - Kernel Exploitation Research Framework Modular framework for studying a Linux privilege escalation LPE vulnerability based on AFALG + Page Cache Injection techniques. 🎯 Objective This project is designed for: Research of Linux kernel vulnerabilities Teaching real exploitation...

CVE-2026-31431-Copy-Fail

CVE-2026-31431 — "Copy Fail": Linux Kernel algifaead Local Privilege Escalation CISA KEV | CVSS 7.8 HIGH | Affects Linux kernels 4.14 – early 2026 9 years Table of Contents 1. Executive Summary 2. Risk Assessment 3. Technical Deep Dive 4. Attack Methodology — Red Team 5. Detection & Incident...

CVE-2026-31431

CopyFail CVE-2026-31431 Overview CopyFail is a proof-of-concept exploit for CVE-2026-31431, targeting a memory corruption vulnerability in the Linux Kernel Crypto API AFALG. The exploit leverages the splice system call to perform unauthorized page-cache patching of the /usr/bin/su binary, enablin...

Mitigaciones

CVE-2026-31431 "Copy Fail" Mitigations Collection of automation scripts and playbooks for the detection and mitigation of vulnerability CVE-2026-31431 local privilege escalation via page cache corruption in setuid binaries on Linux systems. Repository Contents cve-2026-31431-mitigator.sh :...

CVE-2026-31431

CVE-2026-31431 Copy Fail — C PoC Trivial unprivileged LPE by writing 4 controlled bytes into the page cache of any readable file via a logic bug in AFALG kernel 4.14 → early 2026. Corrupt /usr/bin/su in-memory, then run it → root. Build & Run root@kitploit: 1. Generate an ELF payload reverse shel...

CVE-2026-31431-live-process-code-injection

CVE-2026-31431 Copy Fail — Live Process Code Injection PoC Demonstrates arbitrary code execution in a running process via page cache. by @secinfosex What it does: 1. Compiles a test binary: check return 42; in an infinite loop 2. Launches the process 3. Waits for "check = 42" output 4. Replaces...

copyfail-dfir

CVE-2026-31431 Copy Fail — DFIR Investigation Walkthrough An interactive, step-by-step forensic investigation walkthrough for the Copy Fail Linux kernel vulnerability CVE-2026-31431. Click through a realistic incident response scenario — from SIEM alert to confirmed verdict — using real tools and...

copy-fail-CVE-2026-31431-shell

CVE-2026-31431 - copyfail shell Local privilege escalation via AFALG socket + splice page-cache overwrite. Overwrites a read-only SUID binary /usr/bin/su with a minimal ELF that calls setuid0 + execve"/bin/sh". No race condition, no per-distro offsets, single shot. root@kitploit: $...

CVE-2026-31431-python-copyfail-POC

CVE-2026-31431: Copy Fail - Linux Kernel Privilege Escalation Copy Fail CVE-2026-31431 is a critical logic bug in the Linux kernel's cryptographic subsystem that allows unprivileged users to achieve privilege escalation to root. The vulnerability affects Linux kernels 6.0.0 through 6.18.x across...