copy-fail-CVE-2026-31431

Copy Fail - CVE-2026-31431 Technical Writeup Tested Distro / Version Distro| Version ---|--- Ubuntu 24.04 LTS| 6.17.0-1007-aws Amazon Linux 2023| 6.18.8-9.213.amzn2023 RHEL 10.1| 6.12.0-124.45.1.el101 SUSE 16| 6.12.0-160000.9-default...

copy-fail-CVE-2026-31431-detection-probe

Linux Kernel LPE Probe Suite — Copy Fail & Dirty Frag Safe detection tooling for two related Linux kernel local privilege escalation vulnerability families — Copy Fail CVE-2026-31431 and Dirty Frag CVE-2026-43284 / CVE-2026-43500 — both affecting all major distributions since 2017, both exploitab...

CVE-2026-31431-Copy-Fail---Vulnerability-Detection-Script

CVE-2026-31431 — Copy Fail — Vulnerability Detection Script Detection only. A working PoC already exists at copy.fail/exploit. This script is for sysadmins and security teams determining where they are vulnerable — or still vulnerable after patching. What's this about? On April 29th 2026, a...

copy-fail-blocker

copy-fail-blocker BPF-LSM mitigation for CVE-2026-31431 "Copy Fail" and the RxRPC variant of Dirty Frag, and for similar privilege-escalation vulnerabilities that depend on userspace access to a kernel-side in-place crypto path reachable via the AFALG or AFRXRPC socket families. A small DaemonSet...

vcheck

vcheck Audit a remote Linux host over SSH for the Copy Fail and Dirty Frag kernel-module vulnerabilities and, optionally, apply mitigations: CVE| Name| Affected modules ---|---|--- CVE-2026-31431| Copy Fail| algifaead CVE-2026-43284| Dirty Frag IPsec| esp4, esp6, ipcomp4, ipcomp6, xfrmuser...

DIRTYFAIL

DIRTYFAIL A unified detector and PoC harness for the Copy Fail and Dirty Frag Linux page-cache write vulnerability families. ██████╗ ██╗██████╗ ████████╗██╗ ██╗███████╗ █████╗ ██╗██╗ ██╔══██╗██║██╔══██╗╚══██╔══╝╚██╗ ██╔╝██╔════╝██╔══██╗██║██║ ██║ ██║██║██████╔╝ ██║ ╚████╔╝ █████╗ ███████║██║██║ █...

copy-fail-check

copy-fail-check CVE-2026-31431 Helper based on https://copy.fail/ Copy Fail Quick Check Interactive bash helper to review basic exposure related to CVE-2026-31431 Copy Fail and apply a temporary mitigation based on algifaead. Target compatibility Mainly intended for: Debian / Ubuntu AlmaLinux /...

CVE-2026-31431---Copy-Fail-PoC

Description This repository contains an analysis of CVE-2026-31431 Copy Fail in the Linux kernel. It targets local privilege escalation LPE through page cache manipulation. Legal Notice This project is for educational and testing purposes only. Any unauthorized use is the sole responsibility of t...

copy-fail-tiny-elf-CVE-2026-31431

Copy Fail Tiny ELF - CVE-2026-31431 Minimal 436-bytes exploit for Copy Fail, thanks to the power of golfing Magic This ELF ultra golfs the exploit by being totally unmapped, rwx, and by using itself conditionally as the ELF payload to use to poison the cache. More cursed ELF internals golfs comin...

CVE-2026-31431-Linux-Copy-Fail

CVE-2026-31431 - Linux Copy-Fail Exploit Rust A Rust implementation of a local privilege escalation exploit for CVE-2026-31431 Copy-Fail. It allows executing customized shellcode such as Meterpreter Introduction Xint disclosed CVE-2026-31431, an arbitrary page cache write vulnerability that chain...

cPanel-Fix

cPanel & kernel security helper One security-remediation.sh for CVE-2026-41940 cPanel, CVE-2026-31431 kernel "Copy Fail", CSF, optional domain/proxy cleanup, and optional operator hardening. Maintainer: Aria Jahangiri Far Clone git clone https://github.com/MrAriaNet/cPanel-Fix.git cd cPanel-Fix...

asm-copyfail

CVE-2026-31431 Copy Fail — Analysis and development in x86-64 Assembly Based on the source code published in Theori, we will do several exercises until we fully convert it to pure Assembly language without external libraries.python !/usr/bin/env python3 Archivo: copyfail.py import os as...

copy-fail-CVE-2026-31431-cpp

This repository does not have a README...

rootpacket-cve-2026-31431

rootpacket CVE-2026-31431 A Linux Docker-to-host cryptojacking toolkit captured from live attacks on Kinryū Labs honeypots. It breaks in through an exposed Docker Engine API, escapes the container to root the host with CVE-2026-31431 , installs a kernel rootkit, and runs an XMRig Monero miner. Fu...

cve-2026-31431

CVE-2026-31431 — Linux Kernel algifaead "Copy Fail": Analysis Security research on CVE-2026-31431 CVSS 3.1 7.8 HIGH , AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: three composable design flaws in the AFALG AEAD interface chain into a deterministic, race-free 4-byte page-cache write at any offset of any...

CVE-2026-31431_SCA_WAZUH

Wazuh SCA policy: Copy Fail CVE-2026-31431 This policy file: copy-fail-cve-2026-31431-policy.yml is designed to detect likely exposure and mitigation status for Copy Fail / CVE-2026-31431. What this policy checks 1. algifaead is disabled via modprobe policy. 2. algifaead is not currently loaded. ...

copy-fail-go

Copy Fail - CVE-2026-31431 - golang version ⚠️ WARNING: This program is highly dangerous and experimental. Manual cleanup is required to clear the exploit. Use at your own risk! Technical Writeup original repo run check /usr/bin/su before run: user@pc:$ hexdump -n 300 -x /usr/bin/su 0000000 457f...

CVE-2026-31431-poc

Copy Fail Command PoC Wrapper A small modified proof-of-concept wrapper for Copy Fail / CVE-2026-31431 that allows passing a custom command from the terminal instead of always launching an interactive root shell so it can be ran in an none interactive environment such as a web shell. This project...

copy-fail-zig

Copy Fail CVE-2026-31431 Zig implementation Zig implementation of the 732 Byte proof of concept for the Copy Fail Linux LPE CVE-2026-31431, which was disclosed by Theori / Xint on April 29th 2026 The writeup can be found at copy.fail. This implementation has no runtime dependencies and can be run...

CVE-2026-31431-Copy-Fail

This repository does not have a README...