CVE-2026-31431_CopyFail_LinuxKernel_LPE

CVE-2026-31431 — Copy Fail Linux Kernel LPE Educational rewrite of the Theori/Xint proof-of-concept for CVE-2026-31431, a local privilege escalation vulnerability in the Linux kernel's algifaead crypto socket interface. Affects every mainline kernel from 4.14 July 2017 through 6.18.21, and the 6....

copyfail-exploit

Copy Fail · CVE-2026-31431 Local privilege escalation on Linux kernels from 4.11 up to but not including the patched 6.18 releases. The bug lives in the kernel's AFALG socket interface—specifically how authencesn handles scatter-gather lists during in‑place AEAD decryption. The result: an...

CVE-2026-31431

CVE-2026-31431 — Copy Fail Local Privilege Escalation in the Linux kernel's authencesn cryptographic template via AFALG + splice. Disclosed April 29, 2026 by Theori Xint Code. Overview Field| Detail ---|--- CVE| CVE-2026-31431 Nickname| Copy Fail CVSS| 7.8 HIGH Type| Local Privilege Escalation LP...

CVE-2026-31431

Copy Fail - CVE-2026-31431 This repository contains a small Linux local privilege escalation PoC for CVE-2026-31431, also known as "Copy Fail". The exploit targets the Linux kernel algifaead path in the AFALG userspace crypto API. It uses AFALG plus splice to coerce the kernel into writing into t...

CVE-2026-31431-Check

CVE-2026-31431 Copy Fail Vulnerability Check Script Vulnerability Overview CVE-2026-31431 Copy Fail is a Linux kernel local privilege escalation vulnerability that exploits AFALG sockets address family 38 combined with the splice zero-copy system call to bypass file write permissions and tamper...

cve-2026-31431

CVE-2026-31431 Copy Fail Toolkit This repository contains detectors and a PoC for the Linux algifaead / authencesn page-cache scratch-write vulnerability CVE-2026-31431. Disclosure article: https://xint.io/blog/copy-fail-linux-distributions Authorization Notice Only use this on hosts you own or...

CVE-2026-31431-Checker-Mitigator

CVE-2026-31431 Checker & Mitigator A simple, safe vulnerability scanner and mitigation tool for CVE-2026-31431 aka "Copy Fail", a local privilege escalation vulnerability in the Linux kernel's AFALG cryptographic interface. Note - It is fully vibe coded Script About the Vulnerability CVE :...

cve-2026-31431

CVE-2026-31431 This document describes a public Python exploit related to the CVE-2026-31431 vulnerability. The code demonstrates the exploitation of the flaw using primitives from the Linux AFALG subsystem, AEAD cryptographic operations, and memory manipulation via splice, with the goal of...

CVE-2026-31431

🔐 CVE-2026-31431 - Kernel Exploitation Research Framework Modular framework for studying a Linux privilege escalation LPE vulnerability based on AFALG + Page Cache Injection techniques. 🎯 Objective This project is designed for: Research of Linux kernel vulnerabilities Teaching real exploitation...

CVE-2026-31431

AFALG su memory‑patch exploit research A compact Python script that exploits an AFALG‑related kernel vulnerability to patch the su binary in memory and escalate privileges. This is provided for educational and research purposes only. ⚠️ Do not use this on any system you do not own or without...

block-copyfail

Summary CVE-2026-31431 "Copy Fail" is a Linux kernel privilege escalation vulnerability in the algifaead cryptographic interface. An attacker uses AFALG sockets with the authencesn algorithm and splice to corrupt arbitrary files in the kernel page cache — including setuid binaries like /usr/bin/s...

CVE-2026-31431

CopyFail CVE-2026-31431 Overview CopyFail is a proof-of-concept exploit for CVE-2026-31431, targeting a memory corruption vulnerability in the Linux Kernel Crypto API AFALG. The exploit leverages the splice system call to perform unauthorized page-cache patching of the /usr/bin/su binary, enablin...

CVE-2026-31431-Copy-Fail---Advanced-LPE-Proof-of-Concept---C-Rewrite

CVE-2026-31431 "Copy Fail" - Advanced LPE Proof-of-Concept - C Rewrite An advanced, byte-perfect Local Privilege Escalation LPE Proof-of-Concept PoC for CVE-2026-31431 , exploiting a logic flaw in the Linux kernel's cryptography subsystem algifaead. This repository contains a highly optimized C...

copy-fail-CVE-2026-31431-poc

CVE-2026-31431 — Copy Fail Proof of Concept This repository contains a Proof of Concept exploit for CVE-2026-31431 , a high-severity Linux kernel local privilege escalation vulnerability that allows any unprivileged local user to gain root access. The flaw, dubbed “Copy Fail”, resides in the...

copy-fail-CVE-2026-31431-shell

CVE-2026-31431 - copyfail shell Local privilege escalation via AFALG socket + splice page-cache overwrite. Overwrites a read-only SUID binary /usr/bin/su with a minimal ELF that calls setuid0 + execve"/bin/sh". No race condition, no per-distro offsets, single shot. root@kitploit: $...

CVE-2026-31431-Exploit

CVE-2026-31431 "Copy Fail" Exploit A professional proof-of-concept for the CVE-2026-31431 vulnerability, a critical flaw in the Linux kernel's algifaead / authencesn page-cache handling. Overview The CVE-2026-31431 vulnerability, colloquially known as "Copy Fail" , involves a page-cache...

copy-fail-CVE-2026-31431

CVE-2026-31431 — Copy Fail Linux kernel local privilege escalation via AFALG + splice page-cache overwrite For authorized security research, penetration testing, and educational purposes only. Do not use against systems you do not own or have explicit written permission to test. Technical Writeup...

copy_fail

Copy Fail — CVE-2026-31431 CVE-2026-31431 Copy Fail is a local privilege escalation vulnerability in the Linux kernel's algifaead module AFALG subsystem. A logic flaw introduced in August 2017 allows any unprivileged local user to write 4 controlled bytes into the page cache of any readable file...

Copy-Fail---CVE-2026-31431

CVE-2026-31431 - Copy Fail - Detection Script Python script to check whether a Linux system is vulnerable to the CVE-2026-31431 Copy Fail flaw, a local privilege escalation in the Linux kernel. The flaw in brief Since 2017 commit 72548b093ee3, the kernel's algifaead cryptographic module has handl...

CVE-2026-31431-CopyFail-static-ELF--POC

CVE-2026-31431: Copy Fail - 587-byte static ELF I did not find this bug. Credit goes to Xint Code / Theori. This repo is my take on making the exploit as small as possible - a hand-rolled x8664 ELF that does the full LPE in 587 bytes. No libc, no linker, no runtime. Just NASM and stubbornness. In...