CVE-2026-31431 ("Copy Fail") Exploit

A professional proof-of-concept for the CVE-2026-31431 vulnerability, a critical flaw in the Linux kernel's algif_aead / authencesn page-cache handling.

Overview

The CVE-2026-31431 vulnerability, colloquially known as "Copy Fail", involves a page-cache scratch-write bug disclosed on April 29, 2026. It allows an unprivileged local user to corrupt the page-cache view of system-critical files like /etc/passwd or /usr/bin/su without modifying the on-disk file, enabling Local Privilege Escalation (LPE). [1]

Vulnerability Summary

The algif_aead component performs AEAD (Authenticated Encryption with Associated Data) operations in-place. When source data is fed via splice() from a regular file, the destination scatterlist references the file's page-cache pages. The authencesn(hmac(sha256), cbc(aes)) algorithm performs a 4-byte "scratch" write of the AAD's seqno_lo field into the destination, directly corrupting the page-cache copy. [1]

Impacted Distributions

Note: Any kernel carrying commit 72548b093ee3 (dating back to 2017) without the upstream revert is potentially affected.

Toolkit Components

Usage (LPE)

To gain a root shell using the provided exploit script:

python3 exploit.py

The script automates the page-cache corruption of /usr/bin/su or /etc/passwd to elevate privileges. Users are advised to thoroughly review the code before execution, as it interacts with sensitive system components.

Technical Details

The core primitive leverages the following sequence:

1. Initialize sendmsg with 8-byte AAD and specific AEAD controls.
2. splice() the target file descriptor into the operation socket.
3. Trigger recv(), which executes the scratch write before returning an error.

Mitigation

Until a patched kernel is deployed, the algif_aead module should be disabled:

sudo tee /etc/modprobe.d/disable-algif-aead.conf <<<'install algif_aead /bin/false'
sudo rmmod algif_aead 2>/dev/null

Legal Authorization

WARNING: This tool is for educational and authorized security assessment purposes only. Unauthorized use against systems you do not own or have explicit permission to test is illegal and unethical. The authors assume no liability for misuse.

License & Branding

• This project is licensed under the MIT License.
• For official assets and visual guidelines, see brand.md.

References

[1] Xint Blog: Copy Fail - Linux Distributions Disclosure

© 2026 BEN