CVE-2026-43284

Dirty Frag - kernel Linux critical Vulnerability- CVE-2026-43284 📚 Introduction The exploit chain, classified as a Local Privilege Escalation LPE , allows an unprivileged user to obtain root access on virtually all modern Linux distributions running kernels released since 2017, spanning...

Copy-Fail-CVE-2026-31431-Kubernetes-PoC

Copy Fail CVE-2026-31431 — Kubernetes Container Escape PoC A proof-of-concept demonstrating how a fully unprivileged container can achieve node-level code execution on Kubernetes by exploiting the CVE-2026-31431 Linux kernel page-cache corruption bug through shared container image layers. The cor...

CopyFail-CVE-2026-31431

CopyFail: CVE-2026-31431 Python implementation of copy.fail. Overwrites the page cache of a setuid-root binary via AFALG + splice to get root. No race, no offsets works on any Linux distro since 2017. Requirements Python 3.6+ 3.12+ uses os.splice natively; older versions fall back to ctypes Linux...

SplicePrivillegeEscalationFIX

This repository does not have a README...

CVE-2022-0847-Container-Escape

CVE-2022-0847 CVE-2022-0847 used to achieve container escape overwrite any read-only files on host Slides in Chinese available here 利用CVE-2022-0847 Dirty Pipe 实现容器逃逸（效果为覆写宿主机上任意只读文件） 中文汇报PPT在这里 Introduction If the kernel is vulnerable to CVE-2022-0847, the attacker can overwrite read-only files...

cve_2026_31431

CVE-2026-31431 "Copy Fail" Kit de herramientas Detector y LPE de prueba de concepto para el error de escritura temporal en la caché de páginas de Linux algifaead / authencesn divulgado el 2026-04-29. Divulgación del informe: https://xint.io/blog/copy-fail-linux-distributions Autorización Úselo...

Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284

Remote root@kitploit: git clone https://github.com/6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284.git && cd Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284 && gcc -O0 -Wall -o exp exp.c -lutil && ./exp root@kitploit: git clone...

CVE-2022-0847-eBPF

CVE-2022-0847-eBPF An eBPF program to detect and defense attacks on CVE-2022-0847. In the kernel space, the program detects splice system calls, if such a system call contains a pipe as the output fd, and the flags of the pipe buffer is set to PIPEBUFFLAGCANMERGE , then an event would be submitte...

CVE-2022-0847

CVE-2022-0847 Dirty Pipe Linux Kernel Privilege Escalation Analysis toc This article was first published on Huawei Security's official account, this is the blog version more complete First published link: https://mp.weixin.qq.com/s/6VhWBOzJ7uu80nzFxe5jpg Vulnerability Introduction Vulnerability I...

pipe-primitive

pipe-primitive Una primitiva de explotación en el kernel de Linux inspirada en DirtyPipe CVE-2022-0847. Hace unos días, como muchos predecesores en seguridad, estudié y reproduje la vulnerabilidad DirtyPipe CVE-2022-0847, y sentí profundamente lo útil que es este agujero. Este agujero comienza co...

cve-2026-31431

CVE-2026-31431 — Linux Kernel algifaead "Copy Fail": Analysis Security research on CVE-2026-31431 CVSS 3.1 7.8 HIGH , AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: three composable design flaws in the AFALG AEAD interface chain into a deterministic, race-free 4-byte page-cache write at any offset of any...

frida-fuzzer

Frida API Fuzzer v1.4 Copyright C 2020 Andrea Fioraldi [email protected] Released under the Apache License v2.0 This experimental fuzzer is meant to be used for API in-memory fuzzing. The design is highly inspired and based on AFL/AFL++. ATM the mutator is quite simple, just the AFL's havoc...

frida-fuzzer

Fuzzer de API de Frida v1.4 Derechos de autor C 2020 Andrea Fioraldi [email protected] Publicado bajo la Licencia Apache v2.0 Este fuzzer experimental está diseñado para fuzzing de API en memoria. El diseño está altamente inspirado y basado en AFL/AFL++. Por el momento, el mutador es bastant...

Copy-Fail-CVE-2026-31431-Kubernetes-PoC

Copy Fail CVE-2026-31431 — Kubernetes Container Escape PoC A proof-of-concept demonstrating how a fully unprivileged container can achieve node-level code execution on Kubernetes by exploiting the CVE-2026-31431 Linux kernel page-cache corruption bug through shared container image layers...

CVE-2026-31431_CopyFail_LinuxKernel_LPE

CVE-2026-31431 — Copy Fail Linux Kernel LPE Educational rewrite of the Theori/Xint proof-of-concept for CVE-2026-31431, a local privilege escalation vulnerability in the Linux kernel's algifaead crypto socket interface. Affects every mainline kernel from 4.14 July 2017 through 6.18.21, and the 6....

copyfail-exploit

Copy Fail · CVE-2026-31431 Local privilege escalation on Linux kernels from 4.11 up to but not including the patched 6.18 releases. The bug lives in the kernel's AFALG socket interface—specifically how authencesn handles scatter-gather lists during in‑place AEAD decryption. The result: an...

CVE-2026-31431

CVE-2026-31431 — Copy Fail Local Privilege Escalation in the Linux kernel's authencesn cryptographic template via AFALG + splice. Disclosed April 29, 2026 by Theori Xint Code. Overview Field| Detail ---|--- CVE| CVE-2026-31431 Nickname| Copy Fail CVSS| 7.8 HIGH Type| Local Privilege Escalation LP...

CVE-2026-31431

Copy Fail - CVE-2026-31431 This repository contains a small Linux local privilege escalation PoC for CVE-2026-31431, also known as "Copy Fail". The exploit targets the Linux kernel algifaead path in the AFALG userspace crypto API. It uses AFALG plus splice to coerce the kernel into writing into t...

CVE-2026-31431-Check

CVE-2026-31431 Copy Fail Vulnerability Check Script Vulnerability Overview CVE-2026-31431 Copy Fail is a Linux kernel local privilege escalation vulnerability that exploits AFALG sockets address family 38 combined with the splice zero-copy system call to bypass file write permissions and tamper...

cve-2026-31431

CVE-2026-31431 Copy Fail Toolkit This repository contains detectors and a PoC for the Linux algifaead / authencesn page-cache scratch-write vulnerability CVE-2026-31431. Disclosure article: https://xint.io/blog/copy-fail-linux-distributions Authorization Notice Only use this on hosts you own or...