CVE-2026-31431

CVE-2026-31431 - Copy Fail PoC Educational Proof of Concept for CVE-2026-31431 , also known as Copy Fail , a Linux kernel local privilege escalation vulnerability involving the AFALG / algifaead cryptographic interface. !WARNING This repository is provided strictly for educational, defensive, and...

ActBench v0.1.0

ActBench ActBench is a self-evolving benchmark of behavioral safety in cowork agents. It defines behavioral safety as whether an agent's execution remains within the permissions and state changes required by a benign task, and evaluates realized behavioral risk from execution trajectories rather...

yc-mk8s-copy-fail-mitigation

Copy Fail / Dirty Frag Mitigation for Yandex Managed Kubernetes Automatic application of mitigation for vulnerabilities CVE-2026-31431, CVE-2026-43284 and CVE-2026-43500 in the Linux kernel on all worker nodes of a Yandex Managed Kubernetes cluster. Vulnerability Description CVE ID: CVE-2026-4328...

CVE-2026-31431-PoC

Copy Fail - Python 3.9 PoC CVE-2026-31431 The public Copy Fail exploit wasn't compaitble with python 3.9, this one is. The original was modifed by replacing the unavailable os.splice with a lightweight ctypes polyfill. 🚨 LEGAL DISCLAIMER CFAA & Related Laws THIS SOFTWARE IS PROVIDED FOR EDUCATION...

copy-fail-cve-2026-31431

CVE Checker for Copy Fail CVE-2026-31431 Authors/Contributors : Patrick Doyle Author/Maintainer, Effie Renard Co-Author, Kimberly-Lee Banks Co-Author, Chris F. Support/Code Review AI Disclosure : Claude Code used for writing tests files, writing test data, and a code security review. All edits we...

CVE-2026-31431-CopyFail-Lab

CVE-2026-31431 "Copy Fail" — Linux Kernel LPE Lab Overview This repository documents a complete lab investigation of CVE-2026-31431 Copy Fail , a high-severity local privilege escalation LPE vulnerability in the Linux kernel's algifaead cryptographic module, disclosed on April 29, 2026. CVSS Scor...

cve-2026-31431-detection

CVE-2026-31431 "Copy Fail" — Defensive Detection Package A production-ready collection of detection rules and triage guidance for CVE-2026-31431, a Linux kernel local privilege escalation in the algifaead crypto interface disclosed by Theori Xint Code Research. The vulnerability exploits an...

desc_race-1

descrace "descrace" CVE-2021-30955 exploit for iOS 15.0 - 15.1.1 with stable kernel r/w primitives Exploit Method 1. Increase the capacity of IOSurfaceClient array to 0x2000, goal is to write a pointer whose content is totally controlled and then use IOSurfaceRootUserClient interfaces to achieve...

polkit-0.96-CVE-2021-4034

polkit-0.96-CVE-2021-4034 CentOS 7.x already has an RPM package that fixes the CVE-2021-4034 vulnerability, but I couldn't find one for CentOS 6.x. I created and packaged the RPM myself by referring to the source code Red Hat has already fixed 6.x, but I couldn't find a download location...

CVE-2026-31431-CopyFail-Universal-LPE

CVE-2026-31431 "Copy Fail" — Universal LPE Exploit Linux kernel page cache 4-byte arbitrary write → Local Privilege Escalation Multiple exploit approaches: dynamic ELF entry point overwrite, full binary replacement, Python 3.x compatible with ctypes splice fallback. What is this? CVE-2026-31431 i...

copyfail-rs

copyfail-rs Copy Fail exploit CVE-2026-31431 but in Rust, a critical vulnerability chaining AFALG and splice to achieve a 4-byte page cache write, leading to local privilege escalation on major Linux distributions. Based on the research and PoC by Xint Code. Disclaimer !CAUTION This project is fo...

copy-fail-CVE-2026-31431

CVE-2026-31431 — Copy Fail 732 bytes. Any distro. Root. A straight-line logic flaw in the Linux kernel's authencesn cryptographic template enables an unprivileged local user to perform a precise, controlled 4-byte write into the page cache of any readable file — including setuid binaries. No race...

tscan

Telnetd Auth Bypass Scanner CVE-2026-24061 A Python-based scanner for detecting and exploiting the CVE-2026-24061 vulnerability in GNU Inetutils telnetd services. This tool scans IP addresses or networks for vulnerable telnetd services that allow authentication bypass leading to root shell access...

Copy-Fail-Exploit-CVE-2026-31431

Copy Fail CVE-2026-31431 – Exploit Usage Guide ⚠️ Disclaimer This content is for educational and authorized security testing purposes only. Do NOT run this on systems without explicit permission. 📌 Overview Copy Fail CVE-2026-31431 is a Linux Local Privilege Escalation LPE vulnerability affecting...

cve-2024-23113-poc

CVE-2024-23113-poc CVE-2024-23113 is a vulnerability discovered in the Linux Kernel , classified as an arbitrary code execution vulnerability that affects the bpf Berkeley Packet Filter subsystem. Specifically, this vulnerability affects objects of the bpfprog type in bpf programs, and can allow ...

copy-fail-CVE-2026-31431-C

copy-fail-CVE-2026-31431-C Verified on ubuntu 24,ubuntu 25,kali 2026. root@kitploit: gcc -o exploit exploit.c -lz && chmod +x exploit && ./exploit Static compilation root@kitploit: sudo apt install zlib1g-dev gcc -static -o exploit exploit.c -lz or root@kitploit: aarch64-linux-gnu-gcc -o exploit...

COPY-FAIL-Detection-with-Wazuh-4.14.4

COPY FAIL Detection with Wazuh 4.14.4 - CVE-2026-31431 Detection engineering for the Copy Fail kernel LPE · Ubuntu / RHEL / SUSE / Amazon Linux 2023 / Kali What is Copy Fail? CVE-2026-31431 is a logic bug in the Linux kernel's authencesn cryptographic template. It allows any unprivileged local us...

dirtyfrag-patches

Dirty Frag — Kernel Patches Patch series for the Dirty Frag vulnerability class discovered by Hyunwoo Kim @v4bel. Dirty Frag allows an unprivileged local user to overwrite arbitrary bytes of the page cache of read-only files e.g. /usr/bin/su, /etc/passwd leading to local privilege escalation to...

TheLastBundleMismatch

Mysterious patch Let's start this time with the patch that appeared as fix for CVE-2023-45777 in Android Security Bulletin: root@kitploit: diff --git a/services/core/java/com/android/server/accounts/AccountManagerService.java...

ResourcePoison

Fix for this issue has appeared as CVE-2025-22441: bulletin patch follow up Passing ApplicationInfo around ApplicationInfo is structure defining various information about installed app, most notably path to apk file from which resources and code are loaded Usually it is passed from system to...