Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-31431 — Python proof-of-concept for CVE-2026-31431 (Copy Fail), a Linux kernel local privilege escalation via AF_ALG socket and splice() memory corruption, yielding root. | Kitploit
Tools/GitHubGitHub/abiyeenzo/cve-2026-31431
Privilege EscalationMemory ForensicsVulnerability AnalysisExploitationPapers & ResearchBinary Exploitation
GitHubabiyeenzo/cve-2026-31431

CVE-2026-31431

Python proof-of-concept for CVE-2026-31431 (Copy Fail), a Linux kernel local privilege escalation via AF_ALG socket and splice() memory corruption, yielding root.

View Repository
38 days agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Copy Fail - CVE-2026-31431 (LPE)

Description

This repository contains a PoC (Proof of Concept) for the vulnerability CVE-2026-31431, known as Copy Fail, which affects the Linux kernel. It is a local privilege escalation flaw that allows a standard user to obtain root privileges by exploiting improper memory buffer handling during operations combining AF_ALG sockets and the splice() system call.

Discovery and credits

  • Discovered by: Theori security research team (Xint Code).
  • Disclosure date: February 2026.
  • Context: The vulnerability was identified during a security audit of the Linux kernel's cryptographic subsystems and memory buffer manipulation via splice().

Tested distributions and versions

The script was tested and validated on the following environments, under default configurations with no patches applied:

Distribution / OSKernel versionStatus
Ubuntu 24.04 LTS6.17.0-1007-awsVulnerable / Working
Amazon Linux 20236.18.8-9.213.amzn2023Vulnerable / Working
RHEL 10.16.12.0-124.45.1.el10_1Vulnerable / Working
SUSE 166.12.0-160000.9-defaultVulnerable / Working
Kali Linux (WSL2)6.6.87.2-microsoft-standard-WSL2Working (virtualized environment)

(Note: The tests on Kali Linux were performed in a WSL2 (Windows Subsystem for Linux) environment. Since WSL2 kernels are modified by Microsoft, behavior may differ from a native kernel. As kernel 6.6.87 is an LTS branch, Microsoft may have backported the security fix. Make sure the privilege escalation is genuine before validating this test.)

Technical operation

  1. Creating an AF_ALG socket: Configuring an AEAD cipher (authencesn(hmac(sha256),cbc(aes))) via the kernel's socket options.
  2. Memory manipulation via splice(): Using the system call to unintentionally inject or overwrite data into the memory page of a sensitive read-only binary (such as /usr/bin/su).
  3. Executing the payload: Decompressing a zlib payload injected into memory in order to bypass security controls and obtain a root shell via the su call.

Usage

Prerequisites

  • Python 3 interpreter installed.
  • Isolated test environment (virtual machine or container with an unpatched kernel).

Execution

python3 exploit.py
Download Tool