COPY-FAIL

Copy Fail -- CVE-2026-31431 Hardened C implementation for redteam and authorized penetration testing operations. ⚠️ Legal Notice: This tool is intended solely for authorized security research, authorized penetration testing, and defensive analysis. Use on systems you own or have explicit written...

COPY-FAIL-Detection-with-Wazuh-4.14.4

COPY FAIL Detection with Wazuh 4.14.4 - CVE-2026-31431 Detection engineering for the Copy Fail kernel LPE · Ubuntu / RHEL / SUSE / Amazon Linux 2023 / Kali What is Copy Fail? CVE-2026-31431 is a logic bug in the Linux kernel's authencesn cryptographic template. It allows any unprivileged local us...

Linux-CopyFail-C-Version-CVE-2026-31431

Linux CopyFail- C Version - CVE-2026-31431 Clean C version of Copy Fail CVE-2026-31431 - Linux Local Privilege Escalation exploit using AFALG + authencesn + splice primitive. Overwrites the page cache of /usr/bin/su with a tiny setuid shellcode to gain root privileges. Educational proof-of-concep...

Linux-copy-fail-CVE-2026-31431

CVE-2026-31431 — Copy Fail Linux Privilege Escalation Overview This repository presents a technical overview and demonstration of CVE-2026-31431 , commonly referred to as Copy Fail , a Linux kernel vulnerability that enables local privilege escalation. The vulnerability affects a wide range of...

CVE-2026-31431

CVE-2026-31431: Copy Fail PoC + ARM64 Validation Copy Fail is a Linux local privilege escalation published by Theori/Xint as CVE-2026-31431. The project page describes a logic bug in authencesn that can be reached through AFALG and splice, producing a small page-cache write against a setuid binar...

copy-fail-CVE-2026-31431

Vulnerability Description Root Cause In 2017, the Linux kernel crypto module authencesn introduced an in-place optimization for AEAD Authenticated Encryption with Associated Data operations. This optimization caused read-only pages in the page cache to be incorrectly placed into a writable...

XCP_ng_CVE-2026-31431_tester

CVE-2026-31431 "Copy Fail" — XCP-ng Laboratory Detector A safe, non-destructive detector script for CVE-2026-31431 "Copy Fail", validated against XCP-ng 8.3 LTS prior to the May 5, 2026 security update. ⚠️ Authorized use only. Run this script exclusively on systems you own or are explicitly...

GhostShell

GhostShell CVE-2026-31431 — Local Privilege Escalation via Linux Kernel Page Cache Corruption GhostShell is a local privilege escalation tool that exploits a flaw in the Linux kernel's authencesn AEAD crypto implementation to obtain a root shell from an unprivileged user account. It corrupts the...

CVE-2026-31431-Copy-Fail-R-pertoire-de-Pr-vention

🔴 CVE-2026-31431 — Copy Fail Linux Kernel Local Privilege Escalation LPE — Defensive Research Repository 📖 Overview Copy Fail CVE-2026-31431 is a Local Privilege Escalation LPE vulnerability affecting the Linux kernel via controlled corruption of the page cache through the AFALG, splice and...

copy-fail-CVE-2026-31431-IOC

copyfail-detect Detection toolkit for CVE-2026-31431 "Copy Fail", a Linux kernel local privilege escalation technique that corrupts page-cache data without changing the file on disk. Why This Exists Copy Fail can bypass traditional file integrity monitoring because the on-disk file is not modifie...

CVE-2026-31431

CVE-2026-31431 — Copy Fail 中文版 732 Bytes to Root on Every Major Linux Distribution CVE-2026-31431 Copy Fail is a logic bug in the Linux kernel's authencesn cryptographic template. It allows an unprivileged local user to trigger a deterministic, controlled 4-byte write into the page cache of any...

copy-fail-mitigation-with-bpftrace

copy-fail-mitigation-with-bpftrace CVE-2026-31431, AKA Copy Fail, can be mitigated in one-line with bpftrace, no kpatch building, no cargo building English Version | 中文版本 Idea To exploit Copy Fail, you need to bind socket AFALG and use algorithm authencesn , which most applications don't use a lo...

CVE-2026-31431-Exploit

CVE-2026-31431 "Copy Fail" Exploit A professional proof-of-concept for the CVE-2026-31431 vulnerability, a critical flaw in the Linux kernel's algifaead / authencesn page-cache handling. Overview The CVE-2026-31431 vulnerability, colloquially known as "Copy Fail" , involves a page-cache...

copyfail

Copy Fail - CVE-2026-31431 PoC in C Local privilege escalation exploit for CVE-2026-31431 Copy Fail, written in C. How It Works 1. ELF parsing : resolves /usr/bin/su's entry point virtual address to a file offset via PTLOAD program headers 2. AFALG setup : binds to authencesnhmacsha256,cbcaes wit...

cve-2026-31431

CVE-2026-31431 "Copy Fail" - Page Cache Corruption Vulnerability Linux kernel page cache corruption via authencesn AEAD manipulation. ⚠️ IMPORTANT: Exploitation Status Update May 1, 2026 After extensive testing on multiple OpenShift 4.20.16 clusters with RHEL 9.6 kernels: ✅ Page Cache Corruption:...

cve-2026-31431-mitigation

CVE-2026-31431 seccomp Mitigation A lightweight, reversible seccomp-based mitigation for CVE-2026-31431, a local privilege escalation vulnerability in the Linux kernel's algifaead / authencesn crypto subsystem. 中文文档 Vulnerability Overview Type: Local Privilege Escalation LPE Affected Component:...

copyfail

Overview Copy Fail CVE-2026-31431 is a logical vulnerability in the Linux kernel that allows a local unprivileged user to escalate privileges to superuser root. The vulnerability belongs to the Local Privilege Escalation LPE class, does not require complex exploitation conditions such as race...

CVE-2026-31431_CopyFail_LinuxKernel_LPE

CVE-2026-31431 — Copy Fail Linux Kernel LPE Educational rewrite of the Theori/Xint proof-of-concept for CVE-2026-31431, a local privilege escalation vulnerability in the Linux kernel's algifaead crypto socket interface. Affects every mainline kernel from 4.14 July 2017 through 6.18.21, and the 6....

copyfail-exploit

Copy Fail · CVE-2026-31431 Local privilege escalation on Linux kernels from 4.11 up to but not including the patched 6.18 releases. The bug lives in the kernel's AFALG socket interface—specifically how authencesn handles scatter-gather lists during in‑place AEAD decryption. The result: an...

Copy-Fail---CVE-2026-31431

Copy-Fail---CVE-2026-31431 CVE-2026-31431 "Copy Fail" - Analysis and defensive research for the Linux kernel AFALG privilege escalation vulnerability affecting all major distributions since 2017. 100% reliable LPE via authencesn logic flaw Files include a binary , that automates the whole process...