Dirty-Frag-Kubernetes-PoC

Dirty Frag CVE-2026-43284 — Kubernetes Container Escape PoC A proof-of-concept demonstrating how a default, unprivileged Kubernetes Pod can achieve node-level code execution on Amazon EKS by exploiting the Dirty Frag Linux kernel page-cache corruption vulnerability through shared container image...

CVE-2026-31635

🩸 CVE-2026-31635 – DirtyDecrypt Linux Kernel Local Privilege Escalation via RXGK Page Cache Corruption "DirtyDecrypt" — Part of the 2026 "Dirty" family exploits 📖 Overview DirtyDecrypt CVE-2026-31635 is a local privilege escalation vulnerability in the Linux kernel's rxrpc subsystem specifically...

dirtyclone-CVE-2026-43503

CVE-2026-43503 — DirtyClone Linux local privilege escalation. A cloned skbuff loses the SKBFLSHAREDFRAG flag, so ESP in-place decryption writes into file-backed page-cache memory. The PoC patches /etc/passwd in cache to inject a uid-0 account and gives a root shell. Disk is never modified. Fixed ...

page-cache-corruption-lpes

Page Cache Corruption LPEs 3 Linux kernel local privilege escalation exploits. Same bug class as Dirty COW and Dirty Pipe. Root shell in seconds. Every major distro affected. All three corrupt the kernel's page cache — the in-memory copy of files that processes actually read and execute. The...

copy-fail-python

copyfailsu.py Python port of badsectorlabs/copyfail-go CVE-2026-31431. Linux only; requires Python 3.10+ os.splice. How it gets root important This tool does not use the /etc/passwd page-cache trick. It overwrites the page cache of the setuidsu binary with embedded shellcode same payloads as the ...

Copy-fail-CVE-2026-31431-Exploit-in-C

Copy-fail-CVE-2026-31431-Exploit-in-C Discovery and original disclosure of CVE-2026-31431: Theori / Xint. Public writeup: https://copy.fail/. Overview This program targets the Linux kernel’s AFALG AEAD path and attempts to trigger the “Copy Fail” page-cache corruption behavior described in public...

GhostShell

GhostShell CVE-2026-31431 — Local Privilege Escalation via Linux Kernel Page Cache Corruption GhostShell is a local privilege escalation tool that exploits a flaw in the Linux kernel's authencesn AEAD crypto implementation to obtain a root shell from an unprivileged user account. It corrupts the...

copy-fail-CVE-2026-31431-IOC

copyfail-detect Detection toolkit for CVE-2026-31431 "Copy Fail", a Linux kernel local privilege escalation technique that corrupts page-cache data without changing the file on disk. Why This Exists Copy Fail can bypass traditional file integrity monitoring because the on-disk file is not modifie...

django-cve-2020-13254

Django CVE-2020-13254 This repository demonstrates exploitation of CVE-2020-13254 in two ways – via a web interface and via a failing test case. For more details visit: https://danpalmer.me/2020-06-07-django-memcache-vulnerability/ Exploiting via the web The example provides a web interface with ...

CVE-2026-31431-Exploit

CVE-2026-31431 "Copy Fail" Exploit A professional proof-of-concept for the CVE-2026-31431 vulnerability, a critical flaw in the Linux kernel's algifaead / authencesn page-cache handling. Overview The CVE-2026-31431 vulnerability, colloquially known as "Copy Fail" , involves a page-cache...

CVE-2026-46300

🛡️ CVE-2026-46300 - Fragnesia A Clean & Deadly Page-Cache Attack Variant of the "Dirty Frag" family 📌 Overview CVE-2026-46300 Fragnesia is a high-severity logic flaw in the Linux kernel's socket buffer handling skbtrycoalesce within the XFRM/ESP-in-TCP subsystem espintcp ULP. An unprivileged local...

CopyFail-for-dummies

Copy Fail / CVE-2026-31431 — Research Notes Overview This repository contains a cleaned-up technical diagram and supporting notes for the Linux kernel vulnerability commonly referred to as Copy Fail and tracked as CVE-2026-31431. The purpose of this material is: to explain the bug mechanism at a...

dirtypipe

reF: https://access.redhat.com/security/vulnerabilities/RHSB-2022-002 Diagnose A vulnerability detection script has been developed to determine if your system is currently affected by this flaw. To verify the authenticity of the script, you can download the detached OpenPGP signature as well...

dirtyclone-exploit

DirtyClone Exploit Framework CVE-2026-46331 — Linux Kernel Local Privilege Escalation TC pedit + IPsec TEE Page Cache Corruption · Affected kernels: ≤ 6.12.9 ╔═══════════════════════════════════════════════════════════════╗ ║ ║ ║ | \ | | / | | ║ ║ | | | | | '| | | | | | | |/ | ' \ / \ ║ ║ | || | ...

DirtyFrag-for-dummies

Dirty Frag / CVE-2026-43284 — Research Notes Overview This repository contains a cleaned-up technical diagram and supporting notes for the Linux kernel vulnerability commonly referred to as Dirty Frag and tracked for the xfrm-ESP path as CVE-2026-43284. The issue belongs to the broader Dirty Frag...

CVE-2026-31431-Checker-Mitigator

CVE-2026-31431 Checker & Mitigator A simple, safe vulnerability scanner and mitigation tool for CVE-2026-31431 aka "Copy Fail", a local privilege escalation vulnerability in the Linux kernel's AFALG cryptographic interface. Note - It is fully vibe coded Script About the Vulnerability CVE :...

DirtyClone

DirtyClone CVE-2026-43503 - Python PoC Non-official Python port of DirtyClone — a Linux kernel local privilege escalation vulnerability. This repository contains a working Proof of Concept that allows an unprivileged local user to gain root privileges by exploiting page-cache corruption via clone...

CVE-2026-31431_CopyFail_LinuxKernel_LPE

CVE-2026-31431 — Copy Fail Linux Kernel LPE Educational rewrite of the Theori/Xint proof-of-concept for CVE-2026-31431, a local privilege escalation vulnerability in the Linux kernel's algifaead crypto socket interface. Affects every mainline kernel from 4.14 July 2017 through 6.18.21, and the 6....

Weekly-Breach-Investigation--006

Copy Fail Vulnerability CVE-2026-31431 Summary High-severity local privilege escalation flaw in the Linux kernel, allowing unprivileged users to gain root access by corrupting the in-memory page cache. Impacts Linux distributions since 2017 and poses serious risks to cloud and containerized...

packet_edit_meme

PACKETEDITMEME - aka CVE-2026-46331 net/sched actpedit partial-COW page-cache corruption culprit 899ee91156e5, present v5.18 .. fixed v7.1-rc7. packeteditmeme.c turns it into unprivileged local root: a userns CAPNETADMIN child overwrites the cached ELF entry of setuid-root /bin/su with...