Linux CopyFail- C Version - CVE-2026-31431

Clean C version of Copy Fail (CVE-2026-31431) - Linux Local Privilege Escalation exploit using AF_ALG + authencesn + splice primitive. Overwrites the page cache of /usr/bin/su with a tiny setuid shellcode to gain root privileges. Educational proof-of-concept only.

Clean and readable C implementation of the Copy Fail Linux Local Privilege Escalation vulnerability (CVE-2026-31431).

This is a port of the original minified Python exploit.

** Warning**: This is a proof-of-concept for educational and research purposes only. Use only on systems you own or have explicit permission to test.

Features

• Clean, well-commented C code
• No Python dependency
• Works on most Linux distributions affected by the bug (kernels since ~2017)
• Uses AF_ALG + authencesn + splice() primitive

How It Works (Simple Explanation)

The exploit abuses a logic flaw in the Linux kernel's crypto subsystem (algif_aead). It allows an unprivileged user to write 4 controlled bytes into the page cache of any readable file (e.g. /usr/bin/su).

We overwrite the in-memory copy of /usr/bin/su with a tiny setuid shellcode that spawns a root shell.

Build & Run

git clone https://github.com/beatbeast007/Linux-CopyFail-C-Version-CVE-2026-31431
cd Linux-CopyFail-C-Version-CVE-2026-31431bash

make
sudo ./copyfail

Or manually:

gcc src/copyfail.c -o copyfail -lz -Wall -Wextra -O2
./copyfail

Tested On

• Kali Linux
• Ubuntu 24.04

Disclaimer

This exploit only modifies page cache (in memory). Reboot restores the original binary. Running it makes /usr/bin/su temporarily overwritten. Patch your kernel as soon as possible (check your distro security updates).

References

Official Writeup: https://xint.io/blog/copy-fail-linux-distributions Original Python PoC: https://github.com/theori-io/copy-fail-CVE-2026-31431

Legal

This repository is for educational purposes only. I am not responsible for any misuse.

LICENSE

MIT License