CopyFail-CVE-2026-31431

CopyFail: CVE-2026-31431 Python implementation of copy.fail. Overwrites the page cache of a setuid-root binary via AFALG + splice to get root. No race, no offsets works on any Linux distro since 2017. Requirements Python 3.6+ 3.12+ uses os.splice natively; older versions fall back to ctypes Linux...

EUVD-2026-93346

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...

EUVD-2026-92845

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on /score and /rerank...

CVE-2026-105755

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's querykey value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can...

CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC CVE-2026-43494 Proof of concept — uid=1000raken → uid=0root after ./sley on WSL2 6.6.87.2-microsoft-standard-WSL2 Single-file proof-of-concept for CVE-2026-43494 PinTheft: a Linux kernel local privilege escalation that chains an RDS zerocopy reference-count bug with iouring...

Dirty-Frag-CVE-2026-43284

Dirty Frag CVE-2026-43284 and CVE-2026-43500 Exploit Reproduction and Detection Lab for a Linux kernel local privilege escalation chain. Status: VERIFIED. I completed the reproduction, the fileless verification, and the syscall-level detection in the lab kernel 6.18.9+kali-amd64. This document is...

copyfail-exploit

Copy Fail · CVE-2026-31431 Escalada de privilegios local en kernels de Linux desde 4.11 hasta sin incluir las versiones parcheadas 6.18. El fallo reside en la interfaz de sockets AFALG del kernel, específicamente en cómo authencesn maneja las listas scatter-gather durante el descifrado AEAD...

CVE-2026-31431

Copy Fail - CVE-2026-31431 This repository contains a small Linux local privilege escalation PoC for CVE-2026-31431, also known as "Copy Fail". The exploit targets the Linux kernel algifaead path in the AFALG userspace crypto API. It uses AFALG plus splice to coerce the kernel into writing into t...

CVE-2026-31431-Copy-Fail---Advanced-LPE-Proof-of-Concept---C-Rewrite

CVE-2026-31431 "Copy Fail" - Advanced LPE Proof-of-Concept - C Rewrite An advanced, byte-perfect Local Privilege Escalation LPE Proof-of-Concept PoC for CVE-2026-31431 , exploiting a logic flaw in the Linux kernel's cryptography subsystem algifaead. This repository contains a highly optimized C...

copy-fail-CVE-2026-31431-shell

CVE-2026-31431 - copyfail shell Local privilege escalation via AFALG socket + splice page-cache overwrite. Overwrites a read-only SUID binary /usr/bin/su with a minimal ELF that calls setuid0 + execve"/bin/sh". No race condition, no per-distro offsets, single shot. $ ./copyfailexp.sh Kernel:...

copy-fail-CVE-2026-31431

CVE-2026-31431 — Copy Fail Linux kernel local privilege escalation via AFALG + splice page-cache overwrite For authorized security research, penetration testing, and educational purposes only. Do not use against systems you do not own or have explicit written permission to test. Technical Writeup...

CVE-2026-31431-exploit

CVE-2026-31431 WARNING These Linux LPE exploit implementations are runtime-destructive. They overwrite the live page-cache view of privileged targets such as: su PAM configuration files any file passed into patch mode This is usually not a normal persistent on-disk edit, but it does change runtim...

CVE-2026-31431-CopyFail-Lab

CVE-2026-31431 "Copy Fail" — Linux Kernel LPE Lab Overview This repository documents a complete lab investigation of CVE-2026-31431 Copy Fail , a high-severity local privilege escalation LPE vulnerability in the Linux kernel's algifaead cryptographic module, disclosed on April 29, 2026. CVSS Scor...

dirtyfrag-patches

Dirty Frag — Kernel Patches Patch series for the Dirty Frag vulnerability class discovered by Hyunwoo Kim @v4bel. Dirty Frag allows an unprivileged local user to overwrite arbitrary bytes of the page cache of read-only files e.g. /usr/bin/su, /etc/passwd leading to local privilege escalation to...

copyfail-go

CopyFail Go Most Linux LPEs need a race window or a kernel-specific offset. Copy Fail is a straight-line logic flaw — it needs neither. The same 732-byte Python script static Go binary roots every Linux distribution shipped since 2017. A Go implementation of CVE-2026-31431. In case you need a...

Copy-Fail

CVE-2026-31431 – "Copy Fail" Reachability Checker A simple, safe Python script that determines whether a Linux system is vulnerable to CVE-2026-31431 "Copy Fail", a local privilege escalation that affects all major distributions since kernel 4.14. ⚠️ What is Copy Fail? CVE-2026-31431 is a...

CVE-2026-53365

CVE-2026-53365 — VsockDrop:iouring + AFVSOCK Zero-Copy Reference Count Underflow, Page-Cache Overwrite Privilege Escalation HackSpeak distribution mirror. This repository is a distribution mirror of MaherAzzouzi/vsockdrop , with code identical to upstream; upstream does not include a LICENSE, so...

Rocky Linux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (ALMALINUX9.6:CLSA-2026:1767628458)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1767628458 advisory. - When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or...

CVE-2026-31431-Metasploit-exploit

CVE-2026-31431 - Linux Kernel AFALG "Copy Fail" Local Privilege Escalation An automated Metasploit Post-Exploitation module that leverages CVE-2026-31431 popularly known as "Copy Fail" to perform Local Privilege Escalation LPE on vulnerable Linux kernels versions 4.14 through 6.19.12. Description...

GO-2026-6243 New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api

New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api...