CVE-2026-31431-Exploit

CVE-2026-31431 "Copy Fail" Exploit A professional proof-of-concept for the CVE-2026-31431 vulnerability, a critical flaw in the Linux kernel's algifaead / authencesn page-cache handling. Overview The CVE-2026-31431 vulnerability, colloquially known as "Copy Fail" , involves a page-cache...

Copy-fail-CVE-2026-31431-Exploit-in-C

Copy-fail-CVE-2026-31431-Exploit-in-C Discovery and original disclosure of CVE-2026-31431: Theori / Xint. Public writeup: https://copy.fail/. Overview This program targets the Linux kernel’s AFALG AEAD path and attempts to trigger the “Copy Fail” page-cache corruption behavior described in public...

CVE-2026-31431-PoC

CVE-2026-31431 PoC Local Privilege Escalation in the Linux Kernel via algifaead Page Cache Write "Copy Fail" Author: Van Glenndon Enad Original Discovery: Theori / Xint Code Research Team Taeyang Lee Published: April 29, 2026 Severity: High CVSS v3.1 Score: 7.8 CVSS v3.1 Vector:...

CVE-2026-31431-RCE-Exploit

🔴 CVE-2026-31431 — "Copy Fail" A 9-Year-Old Linux Kernel Logic Bug That Grants Root in Seconds Overview Copy Fail is a high-severity local privilege escalation LPE vulnerability in the Linux kernel's cryptographic subsystem algifaead. Discovered and disclosed by Theori via their Xint Code...

RK35xx-CopyFail-Hotfix

RK35xx Kernel Patch: CVE-2026-31431 "Copy Fail" RK35xx CopyFail Hotfix: CVE-2026-31431 Patch for Joshua Riek's Ubuntu 24.04 A community-provided, pre-compiled kernel patch for all RK35xx single-board computers Rock 5, Orange Pi 5, NanoPC, etc. running Joshua Riek's Ubuntu 24.04 Kernel...

CVE-2026-31431

CVE-2026-31431 — Copy Fail 中文版 732 Bytes to Root on Every Major Linux Distribution CVE-2026-31431 Copy Fail is a logic bug in the Linux kernel's authencesn cryptographic template. It allows an unprivileged local user to trigger a deterministic, controlled 4-byte write into the page cache of any...

CopyFail-for-dummies

Copy Fail / CVE-2026-31431 — Research Notes Overview This repository contains a cleaned-up technical diagram and supporting notes for the Linux kernel vulnerability commonly referred to as Copy Fail and tracked as CVE-2026-31431. The purpose of this material is: to explain the bug mechanism at a...

CVE-2026-31431-PocC

CVE-2026-31431-PoC CVE-2026-31431 PoC reproduced in C, usable for exploitation when Python is not available on the target environment. Vulnerability Basic Information Vulnerability type: Linux kernel AFALG subsystem page cache poisoning, achieving local privilege escalation and possible container...

copy-fail-go

copy-fail-go Go port of grenkoca's Python PoC for CVE-2026-31431 copy-fail. This version compiles to a fully static binary with zero runtime dependencies - no Python, no pip, no libc version constraints. Drop it on any Linux target and run it. It also automatically enumerates all SUID...

copy-fail-CVE-2026-31431

Vulnerability Description Root Cause In 2017, the Linux kernel crypto module authencesn introduced an in-place optimization for AEAD Authenticated Encryption with Associated Data operations. This optimization caused read-only pages in the page cache to be incorrectly placed into a writable...

CVE-2026-31431

CVE-2026-31431 - Copy Fail Copy Fail is a logic bug in the Linux kernel's crypto subsystem CVE-2026-31431. A 2017 optimization in algifaead.c accidentally placed page cache pages into a writable scatterlist. The authencesn AEAD algorithm writes 4 scratch bytes past the output boundary during...

copyfail

Overview Copy Fail CVE-2026-31431 is a logical vulnerability in the Linux kernel that allows a local unprivileged user to escalate privileges to superuser root. The vulnerability belongs to the Local Privilege Escalation LPE class, does not require complex exploitation conditions such as race...

CVE-2026-31431

CVE-2026-31431: Copy Fail PoC + ARM64 Validation Copy Fail is a Linux local privilege escalation published by Theori/Xint as CVE-2026-31431. The project page describes a logic bug in authencesn that can be reached through AFALG and splice, producing a small page-cache write against a setuid binar...

CVE-2025-40778

CVE-2025-40778 Proof of Concept Educational demonstration of DNS Cache Poisoning vulnerability via Additional Records injection. ⚠️ Disclaimer FOR EDUCATIONAL PURPOSES ONLY This tool is provided for educational and authorized security testing purposes only. Unauthorized use of this tool against...

copy-fail-mitigate-no-reboot

copy-fail-mitigate Minimal no-reboot mitigation helper for Copy Fail / CVE-2026-31431. This script disables the vulnerable algifaead module path and attempts to unload the module immediately. It also performs a best-effort page-cache eviction for /usr/bin/su. This is a mitigation, not a kernel fi...

CVE-2026-31431

CVE-2026-31431 — "Copy Fail" Local Privilege Escalation Overview CVE-2026-31431 is a local privilege escalation vulnerability in the Linux kernel's algifaead subsystem. The authencesn AEAD implementation performs an in-place decrypt via splice2, placing a page-cache page into the destination...

copyfailautopatch

copyfailautopatch Detect and optionally mitigate CVE-2026-31431 "Copy Fail" on a Linux host. The vulnerability is a page-cache write primitive reachable through the AFALG socket family using the authencesnhmacsha256,cbcaes AEAD transform. This script reproduces the same primitive Theori...

CVE-2026-31431-Copy-Fail---Vulnerability-Detection-Script

CVE-2026-31431 — Copy Fail — Vulnerability Detection Script Detection only. A working PoC already exists at copy.fail/exploit. This script is for sysadmins and security teams determining where they are vulnerable — or still vulnerable after patching. What's this about? On April 29th 2026, a...

CVE-2026-3844

CVE-2026-3844 — Breeze Cache RCE Unauthenticated Arbitrary File Upload → Remote Code Execution...

CVE-2026-31431-Linux-Copy-Fail

CVE-2026-31431 - Linux Copy-Fail Exploit Rust A Rust implementation of a local privilege escalation exploit for CVE-2026-31431 Copy-Fail. It allows executing customized shellcode such as Meterpreter Introduction Xint disclosed CVE-2026-31431, an arbitrary page cache write vulnerability that chain...