CVE-2026-3844

CVE-2026-3844 — Breeze Cache RCE Unauthenticated Arbitrary File Upload → Remote Code Execution...

CVE-2026-31431-Linux-Copy-Fail

CVE-2026-31431 - Linux Copy-Fail Exploit Rust A Rust implementation of a local privilege escalation exploit for CVE-2026-31431 Copy-Fail. It allows executing customized shellcode such as Meterpreter Introduction Xint disclosed CVE-2026-31431, an arbitrary page cache write vulnerability that chain...

CVE-2026-31431_CopyFail_LinuxKernel_LPE

CVE-2026-31431 — Copy Fail Linux Kernel LPE Educational rewrite of the Theori/Xint proof-of-concept for CVE-2026-31431, a local privilege escalation vulnerability in the Linux kernel's algifaead crypto socket interface. Affects every mainline kernel from 4.14 July 2017 through 6.18.21, and the 6....

copyfail-exploit

Copy Fail · CVE-2026-31431 Escalada de privilegios local en kernels de Linux desde 4.11 hasta sin incluir las versiones parcheadas 6.18. El fallo reside en la interfaz de sockets AFALG del kernel, específicamente en cómo authencesn maneja las listas scatter-gather durante el descifrado AEAD...

copyfail-dfir

CVE-2026-31431 Copy Fail — DFIR Investigation Walkthrough An interactive, step-by-step forensic investigation walkthrough for the Copy Fail Linux kernel vulnerability CVE-2026-31431. Click through a realistic incident response scenario — from SIEM alert to confirmed verdict — using real tools and...

copy-fail-CVE-2026-31431-shell

CVE-2026-31431 - copyfail shell Local privilege escalation via AFALG socket + splice page-cache overwrite. Overwrites a read-only SUID binary /usr/bin/su with a minimal ELF that calls setuid0 + execve"/bin/sh". No race condition, no per-distro offsets, single shot. root@kitploit: $...

CVE-2026-3844

CVE-2026-3844 — Breeze Cache = 2.4.4 Unauthenticated Arbitrary File Upload to RCE Overview...

copy-fail-python

copyfailsu.py Python port of badsectorlabs/copyfail-go CVE-2026-31431. Linux only; requires Python 3.10+ os.splice. How it gets root important This tool does not use the /etc/passwd page-cache trick. It overwrites the page cache of the setuidsu binary with embedded shellcode same payloads as the ...

copyfail-check

copyfail-check Shell scripts to detect Linux kernel vulnerabilities, check mitigation status, and guide remediation — designed to run locally or across fleets via SSH, Ansible, or pssh. CVE-2026-31431 — Copy Fail Copy Fail is a high-severity local privilege escalation LPE vulnerability in the Lin...

Copy-Fail---CVE-2026-31431

CVE-2026-31431 - Copy Fail - Detection Script Python script to check whether a Linux system is vulnerable to the CVE-2026-31431 Copy Fail flaw, a local privilege escalation in the Linux kernel. The flaw in brief Since 2017 commit 72548b093ee3, the kernel's algifaead cryptographic module has handl...

cve_2026_31431_audit

CVE-2026-31431 Audit This project provides a professional Python script designed to check if a system is vulnerable to CVE-2026-31431 and demonstrates how to exploit it for research purposes. 🎬 Full Workflow The diagram below illustrates the complete workflow from Environment Audit SCAN, Patch...

GhostShell

GhostShell CVE-2026-31431 — Local Privilege Escalation via Linux Kernel Page Cache Corruption GhostShell is a local privilege escalation tool that exploits a flaw in the Linux kernel's authencesn AEAD crypto implementation to obtain a root shell from an unprivileged user account. It corrupts the...

Linux-copy-fail-CVE-2026-31431

CVE-2026-31431 — Copy Fail Linux Privilege Escalation Overview This repository presents a technical overview and demonstration of CVE-2026-31431 , commonly referred to as Copy Fail , a Linux kernel vulnerability that enables local privilege escalation. The vulnerability affects a wide range of...

CVE-2026-31431

CVE-2026-31431 - Copy Fail PoC Educational Proof of Concept for CVE-2026-31431 , also known as Copy Fail , a Linux kernel local privilege escalation vulnerability involving the AFALG / algifaead cryptographic interface. !WARNING This repository is provided strictly for educational, defensive, and...

CVE-2026-31431-PoC

Copy Fail - Python 3.9 PoC CVE-2026-31431 The public Copy Fail exploit wasn't compaitble with python 3.9, this one is. The original was modifed by replacing the unavailable os.splice with a lightweight ctypes polyfill. 🚨 LEGAL DISCLAIMER CFAA & Related Laws THIS SOFTWARE IS PROVIDED FOR EDUCATION...

CVE-2026-31431

CVE-2026-31431 - Proof-of-Concept Linux algifaead page-cache write to root - Local Privilege Escalation Exploit Writeup https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170 Notes We haven't fully tested yet the PoC, its based on public reference...

CVE-2026-31431-CopyFail-Lab

CVE-2026-31431 "Copy Fail" — Linux Kernel LPE Lab Overview This repository documents a complete lab investigation of CVE-2026-31431 Copy Fail , a high-severity local privilege escalation LPE vulnerability in the Linux kernel's algifaead cryptographic module, disclosed on April 29, 2026. CVSS Scor...

cve-2026-31431-detection

CVE-2026-31431 "Copy Fail" — Defensive Detection Package A production-ready collection of detection rules and triage guidance for CVE-2026-31431, a Linux kernel local privilege escalation in the algifaead crypto interface disclosed by Theori Xint Code Research. The vulnerability exploits an...

CVE-2026-31431-CopyFail-Universal-LPE

CVE-2026-31431 "Copy Fail" — Universal LPE Exploit Linux kernel page cache 4-byte arbitrary write → Local Privilege Escalation Multiple exploit approaches: dynamic ELF entry point overwrite, full binary replacement, Python 3.x compatible with ctypes splice fallback. What is this? CVE-2026-31431 i...

copyfail-rs

copyfail-rs Copy Fail exploit CVE-2026-31431 but in Rust, a critical vulnerability chaining AFALG and splice to achieve a 4-byte page cache write, leading to local privilege escalation on major Linux distributions. Based on the research and PoC by Xint Code. Disclaimer !CAUTION This project is fo...