chernstepanov/copyfail-for-dummiesResearch notes and proof-of-concept for Linux kernel CVE-2026-31431, documenting the AF_ALG splice() page cache corruption bug with source artifacts and a diagram.
This repository contains a cleaned-up technical diagram and supporting notes for the Linux kernel vulnerability commonly referred to as Copy Fail and tracked as CVE-2026-31431.
The purpose of this material is:
AF_ALG, algif_aead, splice(), file-backed pages, and page cache corruption;This repository is not an exploitation guide.
In practical terms, the repository expands and documents the original minimized public copy.fail proof-of-concept in a more inspectable unminified form, including a C++ binary-oriented variant. The included materials are intended for 64-bit systems only.
At a high level, the issue is tied to faulty in-place handling in the algif_aead path.
The important conceptual chain is:
AF_ALG;algif_aead;splice();The core analytical point is the divergence between:
copyfail.cpp — C++ research source artifactcopyfail.py — Python research source artifactcopyfail — compiled C++ binary artifactThe repository also includes a compiled C++ binary artifact built from the C++ source file. Example build command:
g++ -Os -s copyfail.cpp -lz -o copyfail
This repository is provided for defensive research, documentation, and educational analysis only.
Do not use it to target real systems, modify privileged executables, or obtain unauthorized access.