Mitigaciones

CVE-2026-31431 "Copy Fail" Mitigations Collection of automation scripts and playbooks for the detection and mitigation of vulnerability CVE-2026-31431 local privilege escalation via page cache corruption in setuid binaries on Linux systems. Repository Contents cve-2026-31431-mitigator.sh :...

CVE-2026-31431

🔐 CVE-2026-31431 - Kernel Exploitation Research Framework Modular framework for studying a Linux privilege escalation LPE vulnerability based on AFALG + Page Cache Injection techniques. 🎯 Objective This project is designed for: Research of Linux kernel vulnerabilities Teaching real exploitation...

CVE-2026-31431

CopyFail CVE-2026-31431 Overview CopyFail is a proof-of-concept exploit for CVE-2026-31431, targeting a memory corruption vulnerability in the Linux Kernel Crypto API AFALG. The exploit leverages the splice system call to perform unauthorized page-cache patching of the /usr/bin/su binary, enablin...

CVE-2026-31431-live-process-code-injection

CVE-2026-31431 Copy Fail — Live Process Code Injection PoC Demonstrates arbitrary code execution in a running process via page cache. by @secinfosex What it does: 1. Compiles a test binary: check return 42; in an infinite loop 2. Launches the process 3. Waits for "check = 42" output 4. Replaces...

CVE-2026-31431

CVE-2026-31431 Copy Fail — C PoC Trivial unprivileged LPE by writing 4 controlled bytes into the page cache of any readable file via a logic bug in AFALG kernel 4.14 → early 2026. Corrupt /usr/bin/su in-memory, then run it → root. Build & Run root@kitploit: 1. Generate an ELF payload reverse shel...

CVE-2026-31431-python-copyfail-POC

CVE-2026-31431: Copy Fail - Linux Kernel Privilege Escalation Copy Fail CVE-2026-31431 is a critical logic bug in the Linux kernel's cryptographic subsystem that allows unprivileged users to achieve privilege escalation to root. The vulnerability affects Linux kernels 6.0.0 through 6.18.x across...

CVE-2026-31431

CopyFail2 CVE-2026-31431 - Python Implementation Python port of the CopyFail2 kernel exploit leveraging xfrm ESP-in-UDP MSGSPLICEPAGES no-COW fast path for unprivileged Linux local privilege escalation. Replaces a nologin/false entry in /etc/passwd with a passwordless uid-0 user and drops into a...

XCP_ng_CVE-2026-31431_tester

CVE-2026-31431 "Copy Fail" — XCP-ng Laboratory Detector A safe, non-destructive detector script for CVE-2026-31431 "Copy Fail", validated against XCP-ng 8.3 LTS prior to the May 5, 2026 security update. ⚠️ Authorized use only. Run this script exclusively on systems you own or are explicitly...

Linux-CopyFail-C-Version-CVE-2026-31431

Linux CopyFail- C Version - CVE-2026-31431 Clean C version of Copy Fail CVE-2026-31431 - Linux Local Privilege Escalation exploit using AFALG + authencesn + splice primitive. Overwrites the page cache of /usr/bin/su with a tiny setuid shellcode to gain root privileges. Educational proof-of-concep...

copy-fail-CVE-2026-31431-poc

CVE-2026-31431 — Copy Fail Proof of Concept This repository contains a Proof of Concept exploit for CVE-2026-31431 , a high-severity Linux kernel local privilege escalation vulnerability that allows any unprivileged local user to gain root access. The flaw, dubbed “Copy Fail”, resides in the...

cve-2026-31431-copyfail

CVE-2026-31431 — "Copy Fail" 🔐 Educational technical analysis of one of the most significant Linux kernel vulnerabilities since Dirty Pipe 2022. This repository is intended for research, study, and defense. No functional exploit is distributed here. Table of Contents What is it? For laypeople: th...

CVE-2026-31431-Analysis-and-Fix

CVE-2026-31431 "Copy Fail" — Technical Deep Dive Severity: CVSS 7.8 High Class: Local Privilege Escalation Introduced: Linux 4.14 2017 Fixed: commit a664bf3d603d 1. Background CVE-2026-31431 is a local privilege escalation flaw in the Linux kernel's algifaead module — the AEAD socket interface of...

CVE-2026-31431-Exploit

CVE-2026-31431 "Copy Fail" Exploit A professional proof-of-concept for the CVE-2026-31431 vulnerability, a critical flaw in the Linux kernel's algifaead / authencesn page-cache handling. Overview The CVE-2026-31431 vulnerability, colloquially known as "Copy Fail" , involves a page-cache...

Copy-fail-CVE-2026-31431-Exploit-in-C

Copy-fail-CVE-2026-31431-Exploit-in-C Discovery and original disclosure of CVE-2026-31431: Theori / Xint. Public writeup: https://copy.fail/. Overview This program targets the Linux kernel’s AFALG AEAD path and attempts to trigger the “Copy Fail” page-cache corruption behavior described in public...

CVE-2026-31431-PoC

CVE-2026-31431 PoC Local Privilege Escalation in the Linux Kernel via algifaead Page Cache Write "Copy Fail" Author: Van Glenndon Enad Original Discovery: Theori / Xint Code Research Team Taeyang Lee Published: April 29, 2026 Severity: High CVSS v3.1 Score: 7.8 CVSS v3.1 Vector:...

CVE-2026-31431-RCE-Exploit

🔴 CVE-2026-31431 — "Copy Fail" A 9-Year-Old Linux Kernel Logic Bug That Grants Root in Seconds Overview Copy Fail is a high-severity local privilege escalation LPE vulnerability in the Linux kernel's cryptographic subsystem algifaead. Discovered and disclosed by Theori via their Xint Code...

RK35xx-CopyFail-Hotfix

RK35xx Kernel Patch: CVE-2026-31431 "Copy Fail" RK35xx CopyFail Hotfix: CVE-2026-31431 Patch for Joshua Riek's Ubuntu 24.04 A community-provided, pre-compiled kernel patch for all RK35xx single-board computers Rock 5, Orange Pi 5, NanoPC, etc. running Joshua Riek's Ubuntu 24.04 Kernel...

CVE-2026-31431

CVE-2026-31431 — Copy Fail 中文版 732 Bytes to Root on Every Major Linux Distribution CVE-2026-31431 Copy Fail is a logic bug in the Linux kernel's authencesn cryptographic template. It allows an unprivileged local user to trigger a deterministic, controlled 4-byte write into the page cache of any...

CopyFail-for-dummies

Copy Fail / CVE-2026-31431 — Research Notes Overview This repository contains a cleaned-up technical diagram and supporting notes for the Linux kernel vulnerability commonly referred to as Copy Fail and tracked as CVE-2026-31431. The purpose of this material is: to explain the bug mechanism at a...

CVE-2026-31431-PocC

CVE-2026-31431-PoC CVE-2026-31431 PoC reproduced in C, usable for exploitation when Python is not available on the target environment. Vulnerability Basic Information Vulnerability type: Linux kernel AFALG subsystem page cache poisoning, achieving local privilege escalation and possible container...