CVE-2026-31431-CopyFail-Universal-LPE

CVE-2026-31431 "Copy Fail" — Universal LPE Exploit Linux kernel page cache 4-byte arbitrary write → Local Privilege Escalation Multiple exploit approaches: dynamic ELF entry point overwrite, full binary replacement, Python 3.x compatible with ctypes splice fallback. What is this? CVE-2026-31431 i...

copyfail-rs

copyfail-rs Copy Fail exploit CVE-2026-31431 but in Rust, a critical vulnerability chaining AFALG and splice to achieve a 4-byte page cache write, leading to local privilege escalation on major Linux distributions. Based on the research and PoC by Xint Code. Disclaimer !CAUTION This project is fo...

COPY-FAIL-Detection-with-Wazuh-4.14.4

COPY FAIL Detection with Wazuh 4.14.4 - CVE-2026-31431 Detection engineering for the Copy Fail kernel LPE · Ubuntu / RHEL / SUSE / Amazon Linux 2023 / Kali What is Copy Fail? CVE-2026-31431 is a logic bug in the Linux kernel's authencesn cryptographic template. It allows any unprivileged local us...

Copy-Fail_Detect_and_mitigate_CVE-2026-31431

Copy Fail - CVE-2026-31431 Detector and Mitigator Detect exposure to CVE-2026-31431 Copy Fail and optionally apply a host-level mitigation by disabling the algifaead kernel module on vulnerable systems. What this repo provides copyfail-check.sh — checks kernel patch status, runtime module exposur...

cve-2026-31431-mitigation

CVE-2026-31431 seccomp Mitigation A lightweight, reversible seccomp-based mitigation for CVE-2026-31431, a local privilege escalation vulnerability in the Linux kernel's algifaead / authencesn crypto subsystem. 中文文档 Vulnerability Overview Type: Local Privilege Escalation LPE Affected Component:...

copyfail-rs

copyfail-rs Rust implementation of CVE-2026-31431 Copy Fail — a Linux kernel page-cache write primitive via AFALG splice. 中文文档 / Chinese README CVE-2026-31431 The Linux kernel's algifaead implementation allows an unprivileged user to write arbitrary data into the page cache of any readable file v...

Dirty-Frag-Analysis

Dirty Frag Deep Technical Analysis CVE-2026-43284 xfrm-ESP / CVE-2026-43500 RxRPC Linux kernel local privilege escalation vulnerability — PoC reverse engineering · Shellcode breakdown · Patch principles · Detection script Vulnerability Overview Dirty Frag exploits two independent vulnerabilities,...

CVE-2026-31431-exp

Adapted from https://github.com/theori-io/copy-fail-CVE-2026-31431. Added payload encryption and obfuscation, cache write-back to improve system stability, adaptive chunking, zero dependencies, multi-architecture support x86, arm, i386, etc., and other features. In theory, it can be exploited on...

CVE-2026-31431

Copy Fail CVE-2026-31431 - توثيق شامل 1. نظرة عامة على الثغرة اسم الثغرة: Copy Fail معرّف CVE: CVE-2026-31431 اكتُشفت بواسطة / المؤلفون: فريق أبحاث Xint Code بناءً على الأبحاث التأسيسية الأولية للباحث Theori تايونغ لي. "Copy Fail" هي ثغرة منطقية حرجة في قالب التشفير authencesn في نواة لينكس. تسمح...

cve-2026-31431

CVE-2026-31431 — "Copy Fail" Research Repository A 100% reliable Linux local privilege escalation affecting every mainstream distribution since 2017. One logic bug in authencesn, chained through AFALG and splice into a 4-byte page-cache write — silently exploitable for nearly a decade. ⚠️...

CVE-2026-31431

CVE-2026-31431 — "Copy Fail" Local Privilege Escalation in the Linux Kernel crypto algifaead subsystem. Overview CVE-2026-31431, dubbed "Copy Fail", is a logic bug in the Linux kernel's authencesn cryptographic template algifaead. It allows an unprivileged local user to perform a controlled 4-byt...

CVE-2026-31431

🐞 CVE-2026-31431 - Copy Fail A logic flaw in authencesn chained through AFALG and splice into a controlled 4-byte write in the page cache of any readable file on the system. No race condition, no offsets, no compiled payload. The same 732-byte script gains root on every Linux distribution since...

CVE-2026-43284

🚨 CVE-2026-43284 — Dirty Frag 🚨 Universal Linux Kernel Local Privilege Escalation Overview Field| Detail ---|--- CVE| CVE-2026-43284 xfrm/ESP + CVE-2026-43500 RxRPC Nickname| Dirty Frag CVSS| 7.8 HIGH Type| Local Privilege Escalation LPE Introduced| Linux kernel 4.10 2017, commit cac2661c53f3...

copy-fail-cve-2026-31431

Copy Fail - CVE-2026-31431 This repository provides a Go port of the public Copy Fail PoC and a reproducible build pipeline for multi architecture Linux binaries. Copy Fail CVE-2026-31431 is a Linux kernel logic flaw in authencesn that enables a deterministic 4 byte write into page cache data...

Fragnesia-go

fragnesia-go One SA. One byte at a time. No race. Go port of fragnesia CVE-2026-46300. Member of the Dirty Frag vulnerability class - separate bug, same surface, own patch. How it works tl;dr The bug is in the Linux XFRM ESP-in-TCP subsystem. When TCPULP espintcp is installed on a socket after da...

CVE-2026-31431-Copy-Fail-add-arm64

Vulnerability Overview Item| Content ---|--- CVE ID| CVE-2026-31431 Vulnerability Name| Copy Fail Vulnerability Type| Linux Kernel Local Privilege Escalation LPE CVSS 3.1 Score| 7.8 HIGH CWE| CWE-669: Incorrect Resource Transfer Between Spheres Affected Scope| All Linux kernels built between 2017...

cve-2026-31431

CVE-2026-31431 Copy Fail Toolkit This repository contains detectors and a PoC for the Linux algifaead / authencesn page-cache scratch-write vulnerability CVE-2026-31431. Disclosure article: https://xint.io/blog/copy-fail-linux-distributions Authorization Notice Only use this on hosts you own or...

copyfail2_electric_boogaloo_fix

copyfail2electricboogaloofix A temporary mitigation against copyfail variant copyfail2electricboogaloo - Unprivileged Linux LPE via xfrm ESP-in-UDP MSGSPLICEPAGES no-COW fast path. Page-cache write into any readable file. Overwrites a nologin line in /etc/passwd with sick::0:0:…:/:/bin/bash and s...

copy-fail-cve-2026-31431-linux-kernel-page-cache-lpe

Copy Fail CVE-2026-31431 - Vulnerability Checker Conceptual validation script for CVE-2026-31431 "Copy Fail" — a Linux kernel local privilege escalation via algifaead page-cache write. Vulnerability CVE-2026-31431 is a logic bug in the Linux kernel's authencesn AEAD template. When combined with...

copyfail-fix

CopyFail-Fix 🌐 Inglese | Portoghese | Spagnolo | Cinese | Islandese Mitigazione e patch con un comando per CVE-2026-31431 — la vulnerabilità di escalation dei privilegi locali "Copy Fail" del kernel Linux. Lo script disabilita il modulo algifaead interessato, aggiorna il kernel tramite apt e...