tyton

Tyton This Project Is Now Archived Linux Kernel-Mode Rootkit Hunter for 4.4.0-31+. For more information, visit Tyton's website. Detected Attacks Hidden Modules Syscall Table Hooking Network Protocol Hooking Netfilter Hooking Zeroed Process Inodes Process Fops Hooking Interrupt Descriptor Table...

CVE-2026-31431_SCA_WAZUH

Wazuh SCA policy: Copy Fail CVE-2026-31431 This policy file: copy-fail-cve-2026-31431-policy.yml is designed to detect likely exposure and mitigation status for Copy Fail / CVE-2026-31431. What this policy checks 1. algifaead is disabled via modprobe policy. 2. algifaead is not currently loaded. ...

rustproofing-linux

Rustproofing Linux Porting Linux Kernel Bugs to Rust This source code repository is a collection of examples accompanying the blog post at https://research.nccgroup.com/?p=18577. DO NOT USE these examples for anything but following the blog post. They intentionally contain vulnerabilities, and ev...

Paranoid-Dirty-Frag-CVE-2026-43284

Dirty Frag mitigation script This script: 1. Blocks vulnerable kernel modules from loading 2. Unloads them if currently active 3. Verifies mitigation status WARNING: Disables Linux IPsec ESP support esp4/esp6 and RxRPC support. This may break: - strongSwan - libreswan - some enterprise VPNs -...

copy-fail-CVE-2026-31431-mitigation-ansible-playbook

CVE-2026-31431 Mitigation Playbook An Ansible playbook to apply and rollback the CVE-2026-31431 AFALG kernel module mitigation on both Debian/Ubuntu and RHEL/Rocky/AlmaLinux systems. Overview This playbook mitigates CVE-2026-31431 by disabling the vulnerable algifaead kernel module: Debian/Ubuntu...

copy-fail-check

copy-fail-check CVE-2026-31431 Helper based on https://copy.fail/ Copy Fail Quick Check Interactive bash helper to review basic exposure related to CVE-2026-31431 Copy Fail and apply a temporary mitigation based on algifaead. Target compatibility Mainly intended for: Debian / Ubuntu AlmaLinux /...

copy-fail-fix

copy-fail-fix Per-distro mitigation scripts for CVE-2026-31431 "Copy Fail" — a Linux kernel algifaead local privilege escalation that affects essentially every distro shipped since 2017. Each script either installs a patched kernel from your distribution's repos when one is available or, if not,...

copyfail-guard

copyfail-guard A zero-dependency Python CLI that checks whether a Linux host appears exposed to CVE-2026-31431 "Copy Fail" without running an exploit. It can also apply a conservative temporary mitigation when the affected component is loadable as a kernel module. Supports Debian/Ubuntu,...

cve-2026-31431-check

cve-2026-31431-check cve-2026-31431-check is a small Bash triage script for checking local Linux exposure and mitigation indicators for CVE-2026-31431, also known as "Copy Fail." The script targets Debian, Ubuntu, and Debian-family derivatives including Linux Mint, Pop!OS, and similar...

fix-cve-2026-3143

fix-cve-2026-3143 Diagnostics and remediation for CVE-2026-31431 copy fail Installation Copy the installation script to the clipboard and run it in the command line sudo apt install git && cd && git clone https://github.com/ClimbMunchkin/fix-cve-2026-3143.git fix-cve-2026-3143 && chmod +x...

CVE-2026-31431

Test, patch, fix: CVE-2026-31431 Test:Check vuln python3 -c 'import socket;exec"try:s=socket.socketsocket.AFALG,socket.SOCKSEQPACKET,0;s.bind"aead","authencesnhmacsha256,cbcaes";print"vulnerable"\nexcept:print"not vulnerable""' check if module Check if module is loaded in kernel lsmod |...

cve-2026-31431-ftrace

cve-2026-31431 mitigation using ftrace The ebpf solutions around for mitigating cve-2026-31431 require lsm=bpf at boot time, which is usually not set by default. For OracleLinux this was enabled by default in UEKr7u3 and in UEKr8u1 after December 2025. To check whether or not you can use ebpf-lsm...

Copy-Fail

CVE-2026-31431 "Copy Fail" - Local Privilege Escalation Python 3.7+ compatible version including Astra Linux Safe check without exploitation: curl -s https://raw.githubusercontent.com/p401a-ops/Copy-Fail/refs/heads/main/detect.py | python3 Exploitation when prompted, you will need to enter the us...

CVE-2026-31431

CVE-2026-31431 Copy Fail Checker Checks whether a Linux host is vulnerable to CVE-2026-31431 and applies mitigation. Files checkcve202631431.yml - Ansible playbook to verify and patch revertcve202631431.yml - Ansible playbook to undo mitigation runcheck.sh - Script to run verification locally or...

fuck_cve_2026_31431

fuckcve202631431 make KERNELVER=uname -r : for LKM sudo insmod fuck-cve-2026-31431.ko regfakeimpl=1 : for builtin sudo insmod fuck-cve-2026-31431.ko...

Copy_Fail_CVE-2026-31431_test_and_fix

Usage python3 testCVE-2026-31431.py Fix for Almalinux 9 / 10 until kernel update arrive sudo grubby --update-kernel ALL --args="initcallblacklist=algifaeadinit" sudo reboot Fix for Debian / Ubuntu until kernel update arrive as root echo "install algifaead /bin/false"...

KOOBE-Guard

KOOBE-Guard: Active Temporal Mitigation of Kernel Double-Free Vulnerabilities Authors: Vedant Karande & Kiran Kumari Course: Network & Systems Security SIL7165 - Indian Institute of Technology Delhi Overview KOOBE-Guard is a dynamic Intrusion Prevention System IPS developed as a Linux Loadable...

cve-2017-2636-el

cve-2017-2636-el This role installs the workaround documented on https://access.redhat.com/security/cve/CVE-2017-2636 to blacklist the nhdlc module from being loaded. Requirements This role only applies to Red Hat Enterprise Linux versions 6 and 7, and variants CentOS, CloudLinux, etc. License MI...

CVE-2021-28476-tools-env

pack test and exploitdev for POC CVE-2021-28476 from bluefrostsecurity researcher installation guide: cd tools/ ./addtopathtools.sh addition tools for /usr/bin/ remove tools from /usr/bin: cd tools/ ./deltopathtools.sh tools: pocinit: description: preinit env guest host for compile POC see...

d8-copy-fail-mitigation

CVE-2026-31431 Mitigation for Deckhouse Kubernetes Platform Language: English | Русский About the vulnerability CVE-2026-31431 is a vulnerability in the Linux kernel's algifaead module, which exposes the kernel crypto API to userspace through the AFALG socket family. A flaw in the AEAD...