## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-0XFUFFM3-CVE-2026-31431-COPYFAIL
root@kitploit:~
██████╗ ██████╗ ██████╗ ██╗ ██╗ ███████╗ █████╗ ██╗██╗
██╔════╝██╔═══██╗██╔══██╗╚██╗ ██╔╝ ██╔════╝██╔══██╗██║██║
██║ ██║ ██║██████╔╝ ╚████╔╝ █████╗ ███████║██║██║
██║ ██║ ██║██╔═══╝ ╚██╔╝ ██╔══╝ ██╔══██║██║██║
╚██████╗╚██████╔╝██║ ██║ ██║ ██║ ██║██║███████╗
╚═════╝ ╚═════╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝╚═╝╚══════╝
# CVE-2026-31431 — "Copy Fail"
### Linux Kernel Local Privilege Escalation via `algif_aead` Page Cache Corruption
  -yellow?style=for-the-badge&logo=linux&logoColor=black)  
> **⚠️ AUTHORIZED USE ONLY** — This repository is strictly for penetration testers, security researchers, and defenders operating under lawful authorization. Misuse is a criminal offense.
* * *
## 📖 Table of Contents
* * *
## 🔍 What is Copy Fail?
**Copy Fail** is a **local privilege escalation (LPE)** vulnerability disclosed on **April 29, 2026** , affecting virtually every major Linux distribution running kernels since **2017**.
root@kitploit:~
Unprivileged User ──► AF_ALG + splice() ──► 4-byte Page Cache Write ──► ROOT
### Key Facts at a Glance
### Why This Is Dangerous
* 🕵️ **Stealthy** — Modification lives only in the page cache; the file on disk is **never changed**. Standard disk forensics will not detect it.
* ⚡ **Reliable** — Deterministic logic flaw, not a race condition. Exploitation is consistent across environments.
* 🌐 **Universal** — Affects Ubuntu, RHEL, Amazon Linux, SUSE, Debian — every major distro since 2017.
* ☸️ **Cloud/K8s Impact** — Can facilitate container escape in Kubernetes workloads and CI/CD runners.
* 🤖 **AI-Discovered** — Found by Xint Code's AI system with ~1 hour of scan time and a single operator prompt.
* * *
## 🔬 Technical Deep Dive
### Root Cause
The vulnerability stems from a **buggy in-place optimization** introduced in 2017 (`commit 72548b093ee3`) inside the `algif_aead` module of the Linux kernel's userspace crypto API (`AF_ALG`).
root@kitploit:~
AF_ALG (userspace crypto API)
└── algif_aead module
└── authencesn template ◄── VULNERABLE
└── in-place optimization (2017)
└── req->src == req->dst ◄── pages from splice() chained into writable dst scatterlist
### Attack Flow
root@kitploit:~
Step 1: Open AF_ALG AEAD socket
socket(AF_ALG, SOCK_SEQPACKET, 0)
Step 2: Send splice() pages referencing target file
(page cache pages of a privileged binary, e.g. /usr/bin/sudo)
Step 3: Trigger authencesn scratch write
authencesn uses dst buffer as scratch pad →
writes 4 controlled bytes PAST the legitimate output region
Step 4: Page cache entry for the target file is now corrupted
(disk file untouched — only in-memory copy modified)
Step 5: Execute the modified binary → ROOT
### Why the Page Cache?
The Linux kernel's page cache backs in-memory copies of files. When a file is read, its pages are cached. The `splice()` syscall can reference these cached pages directly. By feeding page cache pages into the AF_ALG AEAD scatterlist, the authencesn scratch write lands **inside those cached pages** , effectively patching the in-memory copy of any readable file — including privileged binaries like `sudo`, `pkexec`, or `passwd`.
### The Fix
The upstream fix reverts the flawed 2017 optimization:
root@kitploit:~
# Fixed in commit: a664bf3d603d
git show a664bf3d603d
* * *
## 🖥️ Affected Systems
### Linux Kernel Versions
### Distribution Matrix
* * *
## 📁 Repository Structure
root@kitploit:~
CVE-2026-31431-CopyFail/
│
├── 📄 README.md ← You are here
├── 📄 LICENSE ← Research/Educational license
├── 📄 DISCLAIMER.md ← Legal & ethical use policy
├── 📄 CHANGELOG.md ← Version history
│
├── 📂 docs/
│ ├── vulnerability-analysis.md ← Deep-dive: root cause & mechanics
│ ├── exploitation-walkthrough.md ← Step-by-step methodology
│ ├── affected-kernels.md ← Full kernel/distro version matrix
│ ├── detection.md ← Defender, Tenable, Wazuh coverage
│ └── references.md ← All CVEs, blogs, advisories
│
├── 📂 exploit/
│ ├── README.md ← Usage, prerequisites, tested distros
│ ├── copyfail.py ← Reference PoC (educational)
│ ├── trigger.c ← AF_ALG + splice() C trigger
│ └── variants/
│ ├── ubuntu.py ← Ubuntu-specific variant
│ ├── rhel.py ← RHEL/CentOS variant
│ └── amazon_linux.py ← Amazon Linux variant
│
├── 📂 detection/
│ ├── yara/
│ │ └── copyfail.yar ← YARA rule for exploit artefacts
│ ├── sigma/
│ │ └── copyfail_lpe.yml ← Sigma rule for SIEM/SOC
│ └── scripts/
│ ├── check_vulnerable.sh ← Quick kernel vulnerability check
│ └── detect_algif_aead.sh ← Check if module is loaded/active
│
├── 📂 mitigation/
│ ├── README.md ← Mitigation overview
│ ├── disable_algif_aead.sh ← Disable affected kernel module
│ ├── patch-notes.md ← Upstream patch details
│ └── kubernetes-hardening.md ← K8s / container hardening
│
├── 📂 lab/
│ ├── Vagrantfile ← Reproducible vulnerable VM
│ ├── setup.sh ← Lab bootstrap script
│ └── docker/
│ └── Dockerfile ← Vulnerable Ubuntu container
│
├── 📂 reports/
│ ├── pentest-report-template.md ← Client-ready report template
│ └── sample-finding.md ← Sample finding write-up
│
└── 📂 assets/
├── demo.gif ← (Optional) terminal demo
└── diagrams/
└── page-cache-write.png ← Attack flow diagram
* * *
## 🧪 Lab Setup
> **Always test in an isolated, authorized environment. Never run exploits on production systems.**
### Option A — Vagrant VM (Recommended)
root@kitploit:~
# Clone the repository
git clone https://github.com/0xFuffM3/CVE-2026-31431-CopyFail.git
cd CVE-2026-31431-CopyFail
# Start the vulnerable lab VM
cd lab/
vagrant up
# SSH into the lab
vagrant ssh
# Verify kernel version (should be vulnerable)
uname -r
### Option B — Docker Container
root@kitploit:~
cd lab/docker/
# Build vulnerable container image
docker build -t copyfail-lab .
# Run with required privileges for kernel interaction
docker run --rm -it --privileged copyfail-lab /bin/bash
### Check If Your System Is Vulnerable
root@kitploit:~
# Run the quick check script
chmod +x detection/scripts/check_vulnerable.sh
./detection/scripts/check_vulnerable.sh
Expected output on a **vulnerable** system:
root@kitploit:~
[!] Kernel version: 5.15.0-91-generic
[!] algif_aead module: LOADED
[✗] System appears VULNERABLE to CVE-2026-31431 (Copy Fail)
[*] Recommended action: Apply kernel update or disable algif_aead
Expected output on a **patched** system:
root@kitploit:~
[✓] Kernel version: 6.1.132
[✓] System appears PATCHED against CVE-2026-31431 (Copy Fail)
* * *
## 💥 Exploit Usage
> **Requires:** Local access as an unprivileged user on a vulnerable system.
### Prerequisites
root@kitploit:~
# Python 3.6+
python3 --version
# Required kernel modules present
lsmod | grep algif_aead
# Verify the target binary is readable
ls -la /usr/bin/sudo
### Running the PoC
root@kitploit:~
cd exploit/
# Check current privilege level
id
# uid=1000(user) gid=1000(user) groups=1000(user)
# Run Copy Fail PoC
python3 copyfail.py
# Verify privilege escalation
id
# uid=0(root) gid=0(root) groups=0(root)
### Pentest Workflow
root@kitploit:~
1. Enumerate kernel version
└─► uname -r / cat /proc/version
2. Check if algif_aead is loaded
└─► lsmod | grep algif_aead
3. Confirm low-privilege foothold
└─► id / whoami
4. Execute Copy Fail PoC
└─► python3 exploit/copyfail.py
5. Verify root access
└─► id && cat /etc/shadow
6. Document evidence
└─► Screenshot + log kernel version, distro, exploit hash
7. Apply mitigation (post-test)
└─► sudo bash mitigation/disable_algif_aead.sh
8. Include in pentest report
└─► Use reports/pentest-report-template.md
* * *
## 🔎 Detection
### YARA Rule
root@kitploit:~
// detection/yara/copyfail.yar
rule CopyFail_CVE_2026_31431 {
meta:
description = "Detects Copy Fail (CVE-2026-31431) exploit artefacts"
author = "0xFuffM3"
date = "2026-04-30"
reference = "https://copy.fail"
strings:
$py1 = "algif_aead" ascii
$py2 = "AF_ALG" ascii
$py3 = "splice" ascii
$py4 = "page_cache" ascii
$py5 = "authencesn" ascii
condition:
3 of them
}
Run YARA scan:
root@kitploit:~
yara detection/yara/copyfail.yar /tmp/ -r
### Sigma Rule (SIEM)
root@kitploit:~
# detection/sigma/copyfail_lpe.yml
title: Copy Fail LPE Exploit Execution (CVE-2026-31431)
status: stable
logsource:
category: process_creation
product: linux
detection:
selection:
CommandLine|contains:
- 'AF_ALG'
- 'algif_aead'
- 'authencesn'
condition: selection
falsepositives:
- Legitimate crypto API testing
level: high
### Quick Detection Script
root@kitploit:~
chmod +x detection/scripts/detect_algif_aead.sh
./detection/scripts/detect_algif_aead.sh
### Security Tool Coverage
* * *
## 🛡️ Mitigation
### Option 1 — Apply Kernel Patch (Recommended)
root@kitploit:~
# Ubuntu / Debian
sudo apt-get update && sudo apt-get upgrade linux-image-generic
# RHEL / CentOS
sudo yum update kernel
# Amazon Linux
sudo yum update kernel
# After update, reboot
sudo reboot
### Option 2 — Disable `algif_aead` Module (Interim)
root@kitploit:~
# Run the mitigation script
chmod +x mitigation/disable_algif_aead.sh
sudo bash mitigation/disable_algif_aead.sh
What the script does:
root@kitploit:~
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || echo "[*] Module not currently loaded"
echo "[✓] algif_aead disabled. Reboot to confirm persistence."
### Option 3 — Kubernetes Hardening
See `mitigation/kubernetes-hardening.md` for:
* Restricting `AF_ALG` socket creation in pod security policies
* Seccomp profile to block `socket(AF_ALG, ...)` syscall
* Priority patching for Kubernetes nodes and CI/CD runners
* * *
## 📝 Pentest Reporting
A ready-to-use client report template is in `reports/pentest-report-template.md`.
### Sample Finding Summary
root@kitploit:~
Finding: Local Privilege Escalation via Copy Fail (CVE-2026-31431)
Severity: HIGH (CVSS 7.8)
Host: 10.10.10.55 (ubuntu-prod-01)
Kernel: 5.15.0-91-generic
Evidence:
- Unprivileged shell (uid=1000) escalated to root (uid=0)
- Kernel module algif_aead confirmed loaded
- No disk artefacts — page cache only
Recommendation:
1. Apply vendor kernel patch immediately
2. Interim: disable algif_aead module
3. Review Kubernetes nodes and CI/CD runners
* * *
## ⚖️ Legal & Ethics
> **Read before using anything in this repository.**
This repository is published for **legitimate security research, authorized penetration testing, and defensive security** purposes only.
* ✅ **Allowed:** Testing on systems you own or have explicit written authorization to test
* ✅ **Allowed:** Security research in isolated lab environments
* ✅ **Allowed:** Defensive use — detection, patching, hardening
* ❌ **Prohibited:** Testing on systems without written authorization
* ❌ **Prohibited:** Deploying exploits against production systems
* ❌ **Prohibited:** Any use that violates local, national, or international law
Unauthorized use of this material may violate the **Computer Fraud and Abuse Act (CFAA)** , **EU Directive 2013/40/EU** , **Indian IT Act 2000** , and equivalent laws in your jurisdiction.
The authors assume **no liability** for misuse. See `DISCLAIMER.md` for the full legal notice.
* * *
## 📚 References
* * *
## 🤝 Contributing
Security researchers are welcome to contribute:
1. Fork the repository
2. Create a feature branch: `git checkout -b feat/your-contribution`
3. Commit your changes: `git commit -m "Add: detection rule for X"`
4. Push and open a Pull Request
Please follow responsible disclosure norms. Do not include weaponized, production-ready exploit code targeting patched systems.
* * *
**Made for the security community — use responsibly.**
