CVE-2026-31431

🔐 CVE-2026-31431 - Kernel Exploitation Research Framework Modular framework for studying a Linux privilege escalation LPE vulnerability based on AFALG + Page Cache Injection techniques. 🎯 Objective This project is designed for: Research of Linux kernel vulnerabilities Teaching real exploitation...

ubuntu-cve-2026-31431-mitigation

Complete Guide to Updating the Kernel and kmod in Ubuntu to Fix Security Vulnerabilities CVE CVE-2026-31431 This vulnerability, also known as Copy Fail, is a logic bug in the Linux kernel that occurs in the AFALG / algifaead path. According to the discloser, an unprivileged local user can cause t...

Mitigaciones

CVE-2026-31431 "Copy Fail" Mitigations Collection of automation scripts and playbooks for the detection and mitigation of vulnerability CVE-2026-31431 local privilege escalation via page cache corruption in setuid binaries on Linux systems. Repository Contents cve-2026-31431-mitigator.sh :...

CVE-2026-31431

CopyFail CVE-2026-31431 Overview CopyFail is a proof-of-concept exploit for CVE-2026-31431, targeting a memory corruption vulnerability in the Linux Kernel Crypto API AFALG. The exploit leverages the splice system call to perform unauthorized page-cache patching of the /usr/bin/su binary, enablin...

CVE-2026-31431

CVE-2026-31431 Copy Fail — C PoC Trivial unprivileged LPE by writing 4 controlled bytes into the page cache of any readable file via a logic bug in AFALG kernel 4.14 → early 2026. Corrupt /usr/bin/su in-memory, then run it → root. Build & Run 1. Generate an ELF payload reverse shell example...

copyfail-dfir

CVE-2026-31431 Copy Fail — DFIR Investigation Walkthrough An interactive, step-by-step forensic investigation walkthrough for the Copy Fail Linux kernel vulnerability CVE-2026-31431. Click through a realistic incident response scenario — from SIEM alert to confirmed verdict — using real tools and...

CVE-2026-31431-live-process-code-injection

CVE-2026-31431 Copy Fail — Live Process Code Injection PoC Demonstrates arbitrary code execution in a running process via page cache. by @secinfosex What it does: 1. Compiles a test binary: check return 42; in an infinite loop 2. Launches the process 3. Waits for "check = 42" output 4. Replaces...

CVE-2026-31431

🚨 CVE-2026-31431: Copy Fail A critical 9-year-old flaw in the Linux kernel that allows obtaining root access in seconds 📋 Executive Summary Attribute| Details ---|--- CVE| CVE-2026-31431 Nickname| Copy Fail Type| Local Privilege Escalation LPE CVSS| 7.8 High Discovered by| Theori Xint Code...

CVE-2026-31431-Report-Copy-fail-Vulnerability-

CVE-2026-31431 — Copy Fail: Linux Kernel Privilege Escalation Educational analysis of the Copy Fail vulnerability in the Linux kernel. Covers the memory corruption mechanism, privilege escalation flow, container escape, and defensive countermeasures. ⚠️ Disclaimer This repository is for educationa...

CVE-2026-31431-python-copyfail-POC

CVE-2026-31431: Copy Fail - Linux Kernel Privilege Escalation Copy Fail CVE-2026-31431 is a critical logic bug in the Linux kernel's cryptographic subsystem that allows unprivileged users to achieve privilege escalation to root. The vulnerability affects Linux kernels 6.0.0 through 6.18.x across...

XCP_ng_CVE-2026-31431_tester

CVE-2026-31431 "Copy Fail" — XCP-ng Laboratory Detector A safe, non-destructive detector script for CVE-2026-31431 "Copy Fail", validated against XCP-ng 8.3 LTS prior to the May 5, 2026 security update. ⚠️ Authorized use only. Run this script exclusively on systems you own or are explicitly...

Weekly-Breach-Investigation--006

Copy Fail Vulnerability CVE-2026-31431 Summary High-severity local privilege escalation flaw in the Linux kernel, allowing unprivileged users to gain root access by corrupting the in-memory page cache. Impacts Linux distributions since 2017 and poses serious risks to cloud and containerized...

CVE-2026-31431-live-code-corruption

CVE-2026-31431 — Live Code Corruption via Page Cache A novel exploitation technique for CVE-2026-31431 "Copy Fail" that corrupts executable code of running processes through the Linux kernel's page cache, achieving root privilege escalation. What's Different All published exploits for this CVE...

CVE-2026-31431-Copy-Fail---Advanced-LPE-Proof-of-Concept---C-Rewrite

CVE-2026-31431 "Copy Fail" - Advanced LPE Proof-of-Concept - C Rewrite An advanced, byte-perfect Local Privilege Escalation LPE Proof-of-Concept PoC for CVE-2026-31431 , exploiting a logic flaw in the Linux kernel's cryptography subsystem algifaead. This repository contains a highly optimized C...

copy-fail-CVE-2026-31431-shell

CVE-2026-31431 - copyfail shell Local privilege escalation via AFALG socket + splice page-cache overwrite. Overwrites a read-only SUID binary /usr/bin/su with a minimal ELF that calls setuid0 + execve"/bin/sh". No race condition, no per-distro offsets, single shot. $ ./copyfailexp.sh Kernel:...

copy-fail-CVE-2026-31431-poc

CVE-2026-31431 — Copy Fail Proof of Concept This repository contains a Proof of Concept exploit for CVE-2026-31431 , a high-severity Linux kernel local privilege escalation vulnerability that allows any unprivileged local user to gain root access. The flaw, dubbed “Copy Fail”, resides in the...

CVE-2026-31431

CopyFail2 CVE-2026-31431 - Python Implementation Python port of the CopyFail2 kernel exploit leveraging xfrm ESP-in-UDP MSGSPLICEPAGES no-COW fast path for unprivileged Linux local privilege escalation. Replaces a nologin/false entry in /etc/passwd with a passwordless uid-0 user and drops into a...

cve-2026-31431-copyfail

CVE-2026-31431 — "Copy Fail" 🔐 Educational technical analysis of one of the most significant Linux kernel vulnerabilities since Dirty Pipe 2022. This repository is intended for research, study, and defense. No functional exploit is distributed here. Table of Contents What is it? For laypeople: th...

CVE-2026-31431-REVSHELL

█▀▀ ▄▀█ █ █ █▀█ █▀█ █▀█ ▀█▀ █▀░ █▀█ █ █▄▄ █▀▄ █▄█ █▄█ ░█░ CVE-2026-31431 • Linux Kernel LPE → Root Reverse Shell Overview FailRoot is a weaponized exploit for CVE-2026-31431 — an out-of-bounds write in the Linux kernel's crypto: algifaead subsystem. It chains a privilege escalation with a...

copy-fail-python

copyfailsu.py Python port of badsectorlabs/copyfail-go CVE-2026-31431. Linux only; requires Python 3.10+ os.splice. How it gets root important This tool does not use the /etc/passwd page-cache trick. It overwrites the page cache of the setuidsu binary with embedded shellcode same payloads as the ...