copy_fail

Copy Fail — CVE-2026-31431 CVE-2026-31431 Copy Fail is a local privilege escalation vulnerability in the Linux kernel's algifaead module AFALG subsystem. A logic flaw introduced in August 2017 allows any unprivileged local user to write 4 controlled bytes into the page cache of any readable file...

CVE-2026-31431-CopyFail-static-ELF--POC

CVE-2026-31431: Copy Fail - 587-byte static ELF I did not find this bug. Credit goes to Xint Code / Theori. This repo is my take on making the exploit as small as possible - a hand-rolled x8664 ELF that does the full LPE in 587 bytes. No libc, no linker, no runtime. Just NASM and stubbornness. In...

copy-fail-c

Copy Fail CVE-2026-31431 - Porting C Inglese en ∙ Giapponese ja ∙ Cinese semplificato zh-cn ∙ Coreano ko ∙ Russo ru Una reimplementazione C multipiattaforma dell'LPE Linux Copy Fail CVE-2026-31431, divulgato il 29-04-2026 da Theori / Xint. Consulta il writeup canonico su copy.fail per la...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net/smc: Fixed a double-free of the smcspdpriv variable when tee duplicates the splice pipe buffer. The smcrxsplice function allocates one smcspdpriv per pipebuffer and stores the pointer in pipebuffer.private. The operations...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: ipv4, ipv6: Fixed the handling of transhdrlen in ip,6appenddata. Including transhdrlen in the packet length is a problem when the packet is partially filled e.g., a sendMSGMORE operation occurred previously when appending to a...

CVE-2026-31431-EXPLOIT

CVE-2026-31431 - 복사 실패 이 취약점은 권한 없는 로컬 공격자 가 취약한 Linux 시스템에서 루트 권한 을 획득할 수 있게 합니다. ⚠️ 면책 조항 이 코드는 교육 및 보안 연구 목적으로만 제공됩니다. 이 코드는 Linux 커널의 AFALG 소켓 인터페이스에서 가상의 취약점CVE-2026-31431을 시연합니다. 소유하지 않았거나 명시적인 서면 허가를 받지 않은 시스템에서는 이 코드를 실행하지 마십시오. 이 코드의 오용은 법률과 규정을 위반할 수 있습니다. 📜 설명 CVE-2026-314312026년 공개은...

rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (CVE-2026-43500)

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpcinputcallevent and the RESPONSE handler in rxrpcverifyresponse copy the skb to a linear one before calling into the security o...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

A memory write flaw that is outside the bounds of the system’s security was discovered in the Linux kernel’s Transport Layer Security functionality. This flaw allows a local user to cause a crash or potentially escalate their privileges on the system...

Astra Linux – Vulnerability in Linux 5.10

There exists a use-after-free vulnerability in the Linux kernel through the iouring mechanism and the IORINGOPSPLICE operation. If the IORINGOPSPLICE operation lacks the IOWQWORKFILES flag, it indicates that the operation will not utilize current-nsproxy. As a result, its reference counter is not...

CVE-2026-89499 ring-buffer: Stop remote reader update when page swap fails

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swapreaderpage callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer...

PT-2026-90215

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ring-buffer page swap mechanism where the swap reader page callback may return -EBUSY if the writer moves the head before the remote reader catches it, which is...

PT-2026-96375

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smc rx pipe buf release smc rx splice hands RMB pages to a pipe and takes a socket reference per entry so the smc sock stays alive until the reader finishes. The connection does not: a concurrent...

copy-fail-python

copy-fail-python A compact, zero-dependency Python proof-of-concept for Copy Fail CVE-2026-31431, a Linux kernel local privilege escalation through AFALG and splice that corrupts the page cache of a readable file such as /usr/bin/su. This is a port of the Theori PoC with two practical changes: th...

SUSE CVE-2026-80904

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...

CVE-2026-80904

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...

AZL-99525 CVE-2026-80904 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...

CVE-2026-80904 net/tls: Fail tls_sw_splice_read() after a failed async decrypt

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...

CVE-2026-80904

CVE-2026-80904 is a Linux kernel vulnerability in the net/tls (TLS offload) subsystem. When an asynchronous TLS decryption fails, tls_sw_recvmsg() and tls_sw_read_sock() correctly check async_wait.err and abort the read, but tls_sw_splice_read() performs no such check. As a result, a splice opera...

EUVD-2026-71663

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...

CVE-2026-80904 net/tls: Fail tls_sw_splice_read() after a failed async decrypt

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...