CVE-2026-31431-Metasploit-exploit

CVE-2026-31431 - Linux Kernel AFALG "Copy Fail" Local Privilege Escalation An automated Metasploit Post-Exploitation module that leverages CVE-2026-31431 popularly known as "Copy Fail" to perform Local Privilege Escalation LPE on vulnerable Linux kernels versions 4.14 through 6.19.12. Description...

CVE-2026-46331

CVE-2026-46331 pedit COW – Linux net/sched Packet-Editor Page-Cache Poisoning Vulnerability Executive Summary CVE-2026-46331 nicknamed “pedit COW” is a local Linux kernel privilege-escalation flaw in the traffic-control subsystem. An unprivileged user in an unprivileged network namespace can...

DirtyClone

DirtyClone CVE-2026-43503 - Python PoC Non-official Python port of DirtyClone — a Linux kernel local privilege escalation vulnerability. This repository contains a working Proof of Concept that allows an unprivileged local user to gain root privileges by exploiting page-cache corruption via clone...

tetragon-dirtyfrag

tetragon-dirtyfrag Blocking the DirtyFrag Linux privilege-escalation chain CVE-2026-43284 / CVE-2026-43500 at runtime with a Cilium Tetragon TracingPolicy. The policy SIGKILLs the public proof-of-concept at its socket-setup step, before it reaches the page-cache write that would give it root. Wha...

dirtyfrag

Dirty Frag: Universal Linux LPE Abstract This document describes the Dirty Frag vulnerability class, first discovered and reported by Hyunwoo Kim @v4bel, which can obtain root privileges on major Linux distributions by chaining the xfrm-ESP Page-Cache Write CVE-2026-43284 vulnerability and the...

DirtyFrag-for-dummies

Dirty Frag / CVE-2026-43284 — Research Notes Overview This repository contains a cleaned-up technical diagram and supporting notes for the Linux kernel vulnerability commonly referred to as Dirty Frag and tracked for the xfrm-ESP path as CVE-2026-43284. The issue belongs to the broader Dirty Frag...

Exploit for Write-what-where Condition in Linux Linux_Kernel

iQOO Neo7 Race Edition PD2232 — DirtyFrag Temporary Root...

CVE-2022-0847

CVE-2022-0847 Dirty Pipe Linux Kernel Privilege Escalation Analysis toc This article was first published on Huawei Security's official account, this is the blog version more complete First published link: https://mp.weixin.qq.com/s/6VhWBOzJ7uu80nzFxe5jpg Vulnerability Introduction Vulnerability I...

COPY-FAIL

Copy Fail -- CVE-2026-31431 Hardened C implementation for redteam and authorized penetration testing operations. ⚠️ Legal Notice: This tool is intended solely for authorized security research, authorized penetration testing, and defensive analysis. Use on systems you own or have explicit written...

Copy-Fail-CVE-2026-31431-Kubernetes-PoC

Copy Fail CVE-2026-31431 — Kubernetes Container Escape PoC A proof-of-concept demonstrating how a fully unprivileged container can achieve node-level code execution on Kubernetes by exploiting the CVE-2026-31431 Linux kernel page-cache corruption bug through shared container image layers. The cor...

CVE-2026-46331

🚨 CVE-2026-46331 - Linux Kernel COW Bug Linux Kernel net/sched Partial Copy-on-Write COW Page Cache Corruption -orange?style=for-the-badge A Linux kernel vulnerability caused by incorrect Copy-on-Write COW handling in the traffic control tc packet editing subsystem. 📖 Overview CVE-2026-46331 is a...

CVE-2022-0847-Linux

CVE-2022-0847 Description - POC for CVE-2022-0847: Linux Kernel Local Privilege Escalation Vulnerability. - create by antx at 2022-03-08. Detail - Security researcher Max Kellermann responsibly disclosed the 'Dirty Pipe' vulnerability and stated that it affects Linux Kernel 5.8 and later...

pagecache-lpe-containment-kit

Page-Cache LPE Containment Kit Detect, contain, and verify defenses against two Linux page-cache-corruption local privilege escalations — DirtyClone CVE-2026-43503 and pedit COW CVE-2026-46331 — on hosts and containers. This is an educational, defensive security kit. It explains how both...

cve-2026-31431

CVE-2026-31431 — Copy Fail: Linux Kernel LPE Research Lab Educational purposes only. Do NOT use on systems without explicit authorization. Index Description of the vulnerability Affected components How it works Lab setup Docker PoC — Demonstration Mitigation References Vulnerability Description...

SUSE CVE-2026-99284

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skbzerocopy skbzerocopy moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skbshinfofrom-flags into skbshinfoto-flags. A destination sk...

CVE-2026-99284

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skbzerocopy skbzerocopy moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skbshinfofrom-flags into skbshinfoto-flags. A destination sk...

DEBIAN-CVE-2026-99284

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skbzerocopy skbzerocopy moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skbshinfofrom-flags into skbshinfoto-flags. A destination sk...

AZL-112868 CVE-2026-99284 affecting package kernel 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skbzerocopy skbzerocopy moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skbshinfofrom-flags into skbshinfoto-flags. A destination sk...

CVE-2026-99284

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skbzerocopy skbzerocopy moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skbshinfofrom-flags into skbshinfoto-flags. A destination sk...

EUVD-2026-119329

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skbzerocopy skbzerocopy moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skbshinfofrom-flags into skbshinfoto-flags. A destination sk...