Weekly-Breach-Investigation--006

Copy Fail Vulnerability CVE-2026-31431 Summary High-severity local privilege escalation flaw in the Linux kernel, allowing unprivileged users to gain root access by corrupting the in-memory page cache. Impacts Linux distributions since 2017 and poses serious risks to cloud and containerized...

packet_edit_meme

PACKETEDITMEME - aka CVE-2026-46331 net/sched actpedit partial-COW page-cache corruption culprit 899ee91156e5, present v5.18 .. fixed v7.1-rc7. packeteditmeme.c turns it into unprivileged local root: a userns CAPNETADMIN child overwrites the cached ELF entry of setuid-root /bin/su with...

dirtyclone-CVE-2026-43503

CVE-2026-43503 — DirtyClone Linux local privilege escalation. A cloned skbuff loses the SKBFLSHAREDFRAG flag, so ESP in-place decryption writes into file-backed page-cache memory. The PoC patches /etc/passwd in cache to inject a uid-0 account and gives a root shell. Disk is never modified. Fixed ...

copy-fail-python

copyfailsu.py Python port of badsectorlabs/copyfail-go CVE-2026-31431. Linux only; requires Python 3.10+ os.splice. How it gets root important This tool does not use the /etc/passwd page-cache trick. It overwrites the page cache of the setuidsu binary with embedded shellcode same payloads as the ...

CVE-2026-31431-Checker-Mitigator

CVE-2026-31431 Checker & Mitigator A simple, safe vulnerability scanner and mitigation tool for CVE-2026-31431 aka "Copy Fail", a local privilege escalation vulnerability in the Linux kernel's AFALG cryptographic interface. Note - It is fully vibe coded Script About the Vulnerability CVE :...

CVE-2026-46300

🛡️ CVE-2026-46300 - Fragnesia A Clean & Deadly Page-Cache Attack Variant of the "Dirty Frag" family 📌 Overview CVE-2026-46300 Fragnesia is a high-severity logic flaw in the Linux kernel's socket buffer handling skbtrycoalesce within the XFRM/ESP-in-TCP subsystem espintcp ULP. An unprivileged local...

DirtyFrag-for-dummies

Dirty Frag / CVE-2026-43284 — Research Notes Overview This repository contains a cleaned-up technical diagram and supporting notes for the Linux kernel vulnerability commonly referred to as Dirty Frag and tracked for the xfrm-ESP path as CVE-2026-43284. The issue belongs to the broader Dirty Frag...

ubuntu-cve-2026-31431-mitigation

Complete Guide to Updating the Kernel and kmod in Ubuntu to Fix Security Vulnerabilities CVE CVE-2026-31431 This vulnerability, also known as Copy Fail, is a logic bug in the Linux kernel that occurs in the AFALG / algifaead path. According to the discloser, an unprivileged local user can cause t...

copy-fail-CVE-2026-31431-IOC

copyfail-detect Detection toolkit for CVE-2026-31431 "Copy Fail", a Linux kernel local privilege escalation technique that corrupts page-cache data without changing the file on disk. Why This Exists Copy Fail can bypass traditional file integrity monitoring because the on-disk file is not modifie...

DirtyFrag-go

dirtyfrag-go Two bugs. One shell. No disk writes. Go port of dirtyfrag CVE-2026-43284 / CVE-2026-43500. How it works tl;dr The bug class is in the Linux kernel XFRM subsystem. When a file page is spliced into a pipe and then into an ESP-encrypted socket, the kernel decrypts the ESP payload in-pla...

dirtyclone-exploit

DirtyClone Exploit Framework CVE-2026-46331 — Linux Kernel Local Privilege Escalation TC pedit + IPsec TEE Page Cache Corruption · Affected kernels: ≤ 6.12.9 ╔═══════════════════════════════════════════════════════════════╗ ║ ║ ║ | \ | | / | | ║ ║ | | | | | '| | | | | | | |/ | ' \ / \ ║ ║ | || | ...

CVE-2026-46331

🚨 CVE-2026-46331 - Linux Kernel COW Bug Linux Kernel net/sched Partial Copy-on-Write COW Page Cache Corruption -orange?style=for-the-badge A Linux kernel vulnerability caused by incorrect Copy-on-Write COW handling in the traffic control tc packet editing subsystem. 📖 Overview CVE-2026-46331 is a...

Copy-Fail-CVE-2026-31431-Kubernetes-PoC

Copy Fail CVE-2026-31431 — Kubernetes Container Escape PoC A proof-of-concept demonstrating how a fully unprivileged container can achieve node-level code execution on Kubernetes by exploiting the CVE-2026-31431 Linux kernel page-cache corruption bug through shared container image layers. The cor...

DirtyClone

DirtyClone CVE-2026-43503 - Python PoC Non-official Python port of DirtyClone — a Linux kernel local privilege escalation vulnerability. This repository contains a working Proof of Concept that allows an unprivileged local user to gain root privileges by exploiting page-cache corruption via clone...

CVE-2026-31431

CVE-2026-31431 — Copy Fail 中文版 732 Bytes to Root on Every Major Linux Distribution CVE-2026-31431 Copy Fail is a logic bug in the Linux kernel's authencesn cryptographic template. It allows an unprivileged local user to trigger a deterministic, controlled 4-byte write into the page cache of any...

pedit-cow

CVE-2026-46331 is a Linux kernel privilege escalation vulnerability involving the traffic control subsystem and page cache corruption. Requirements: Linux x8664 GCC iproute2 tc Vulnerable kernel Exploitation Flow: SUID Enumeration ↓ Target Selection ↓ ELF Analysis ↓ tc / Netlink / pedit ↓ Page...

Dirty-Frag

💥 CVE-2026-43284 — Dirty Frag 💥 ⚡ Dirty Frag Local Privilege Escalation Proof of Concept ⚡ 📖 Description This repository contains a Proof of Concept PoC for: CVE-2026-43284 — Dirty Frag The exploit demonstrates a vulnerability affecting vulnerable Linux systems. 🧠 About Dirty Frag Dirty Frag...

Copy-Fail-CVE-2026-31431-Kubernetes-PoC

Copy Fail CVE-2026-31431 — Kubernetes Container Escape PoC A proof-of-concept demonstrating how a fully unprivileged container can achieve node-level code execution on Kubernetes by exploiting the CVE-2026-31431 Linux kernel page-cache corruption bug through shared container image layers...

dirtypipe

reF: https://access.redhat.com/security/vulnerabilities/RHSB-2022-002 Diagnose A vulnerability detection script has been developed to determine if your system is currently affected by this flaw. To verify the authenticity of the script, you can download the detached OpenPGP signature as well...

copy-fail-mcp

Copy Fail MCP 📖 Installation Guide — quick start, manual setup, and troubleshooting CVE-2026-31431 — The worst Linux vulnerability ever discovered. Now controllable via MCP. 732 bytes of Python. No compilation. No race condition. No per-distro offsets. One shot, universal root on every Linux kern...