adityasingh108/cve-2026-31431-metasploit-exploit
Automated Metasploit post-exploitation module for CVE-2026-31431 ("Copy Fail"). Weaponizes a deterministic logic flaw in the Linux kernel AF_ALG subsystem to achieve local privilege escalation (LPE) to root by safely corrupting a setuid binary directly in the shared Page Cache (RAM) without modifying files on disk
An automated Metasploit Post-Exploitation module that leverages CVE-2026-31431 (popularly known as "Copy Fail") to perform Local Privilege Escalation (LPE) on vulnerable Linux kernels (versions 4.14 through 6.19.12).
The module exploits a logic flaw within the Linux kernel’s cryptographic subsystem (algif_aead module of the AF_ALG interface). Due to an improper in-place memory optimization, an unprivileged local user can use the splice() system call to map a read-only system binary (such as /usr/bin/su or /usr/bin/sudo) into an AF_ALG socket and perform a controlled 4-byte overwrite directly in the system Page Cache (RAM).
By corrupting specific privilege-checking instructions of a setuid binary in memory, the module bypasses access controls and spawns a root shell without modifying the physical file on disk.
shell and meterpreter sessionsregister_file_for_cleanup4.14 to 6.19.12git clone https://github.com/adityasingh108/CVE-2026-31431-Metasploit-exploit
cd CVE-2026-31431-Metasploit-exploit
Metasploit custom modules should be placed inside the local user module path:
~/.msf4/modules/
Create the required directory structure if it does not already exist:
~/.msf4/modules/
└── post/
└── linux/
└── escalation/
Copy the copy_fail.rb file into the following directory:
~/.msf4/modules/post/linux/escalation/
Final structure:
~/.msf4/modules/
└── post/
└── linux/
└── escalation/
└── copy_fail.rb
Start the Metasploit console:
msfconsole
Reload all modules:
reload_all
Load the exploit module:
use post/linux/escalation/copy_fail
show options
set SESSION 1
run
or
exploit
msfconsole
use post/linux/escalation/copy_fail
show options
set SESSION 1
run
The module targets vulnerable Linux kernels:
4.14 <= Kernel Version <= 6.19.12
This project is provided for educational purposes and authorized security research only. Unauthorized use against systems you do not own or have explicit permission to test may violate applicable laws and regulations.
Use responsibly.