Exploit for CVE-2026-31431

copyFail.py — CVE Exploit Analysis Report Summary copyFa...

Exploit for CVE-2026-31431

copyfail-rs A Rust implementation of the Copy Fail exploi...

Exploit for CVE-2026-31431

CVE-2026-31431 — "Copy Fail" Local Privilege Escalation Ov...

Exploit for CVE-2026-31431

Copy Fail CVE-2026-31431 — Kubernetes Container Escape PoC...

exploits

Copyfail Privilege escalation...

Exploit for CVE-2026-31431

CVE-2026-31431 Copy Fail Detection Toolkit Detection and an...

Exploit for CVE-2026-31431

cve-2026-31431 732 bytes required to execute root on all majo...

Exploit for CVE-2026-31431

Copy-Fail CVE-2026-31431 Static Go PoC This repository contai...

Exploit for CVE-2026-31431

Copy-Fail Exploit CVE-2026-31431 Local privilege escalation...

Exploit for CVE-2026-31431

CopyFail: CVE-2026-31431 Python implementation of copy.fail...

Copy Fail AF_ALG + authencesn Page-Cache Write

CVE-2026-31431 is a logic flaw in the Linux kernel's authencesn AEAD template that, when reached via the AFALG socket interface combined with splice, allows an unprivileged local user to perform a controlled 4-byte write into the page cache of any readable file. Because the corrupted pages are...

net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer

...

SUSE CVE-2026-31507

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smcspdpriv when tee duplicates splice pipe buffer smcrxsplice allocates one smcspdpriv per pipebuffer and stores the pointer in pipebuffer.private. The pipebufoperations for these buffers used .get =...

EUVD-2026-24885

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smcspdpriv when tee duplicates splice pipe buffer smcrxsplice allocates one smcspdpriv per pipebuffer and stores the pointer in pipebuffer.private. The pipebufoperations for these buffers used .get =...

CVE-2026-31507

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smcspdpriv when tee duplicates splice pipe buffer smcrxsplice allocates one smcspdpriv per pipebuffer and stores the pointer in pipebuffer.private. The pipebufoperations for these buffers used .get =...

CVE-2026-31507 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smcspdpriv when tee duplicates splice pipe buffer smcrxsplice allocates one smcspdpriv per pipebuffer and stores the pointer in pipebuffer.private. The pipebufoperations for these buffers used .get =...

CVE-2026-31507 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smcspdpriv when tee duplicates splice pipe buffer smcrxsplice allocates one smcspdpriv per pipebuffer and stores the pointer in pipebuffer.private. The pipebufoperations for these buffers used .get =...

CVE-2026-31507

CVE-2026-31507 affects the Linux kernel SMC module (net/smc). The vulnerability is a double-free of the per-buffer state (smc_spd_priv) when tee(2) duplicates a splice pipe buffer, leading to a use-after-free and a kernel NULL pointer dereference, ultimately causing a kernel panic. The root cause...

PT-2026-34412

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the SMC implementation of the Linux kernel. The smc rx splice function allocates an smc spd priv object per pipe buffer and stores the pointer in pipe...

Linux Distros Unpatched Vulnerability : CVE-2026-31507

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/smc: fix double-free of smcspdpriv when tee duplicates splice pipe buffer smcrxsplice allocates one smcspdpriv per pipebuffer and stores the pointer in...