dennisdgr/cve-2026-31431-pocAn adapted version of the copy fail exploit to use parameters instead of dropping you into a root shell
A small modified proof-of-concept wrapper for Copy Fail / CVE-2026-31431 that allows passing a custom command from the terminal instead of always launching an interactive root shell so it can be ran in an none interactive environment such as a web shell.
This project is based on the public Copy Fail research and PoC.
This repository is provided for educational, research, and defensive validation purposes only.
Only run this code on systems you own or have explicit permission to test.
This PoC may corrupt the in-memory page cache of a target binary such as /usr/bin/su.
Do not run this on production systems.
Copy Fail, tracked as CVE-2026-31431, is a Linux kernel local privilege-escalation vulnerability involving the kernel crypto API, specifically the AF_ALG / algif_aead path.
At a high level, the bug can allow controlled writes into the page cache of readable files. Public demonstrations commonly target SUID binaries such as /usr/bin/su to gain root privileges.
This repository does not claim discovery of the vulnerability. It is a small modification/wrapper around the public PoC behavior to support a configurable command payload.
Full credit for the original research, vulnerability disclosure, and public PoC goes to the original authors and researchers:
THEORI Copy Fail PoC:
https://github.com/theori-io/copy-fail-CVE-2026-31431
Official Copy Fail website:
https://copy.fail/
Xint technical write-up:
https://xint.io/blog/copy-fail-linux-distributions
Please read and reference the original material for the real vulnerability analysis.
The original public PoC is extremely compact and uses a fixed embedded payload.
This version adds:
The target system must expose the required Linux crypto socket interfaces.
The PoC depends on:
AF_ALG supportalgif_aead support/usr/bin/suDefault verification:
python3 CVE-2026-31431.py
This attempts to execute:
id > /tmp/id.txt
Then verify:
cat /tmp/id.txt
Custom command:
python3 CVE-2026-31431.py -c 'ls -la /root'
/usr/bin/suIf you tested against /usr/bin/su, restore it after testing.
On Debian/Ubuntu:
sudo apt install --reinstall util-linux
This repository is only a small adaptation of the public Copy Fail PoC behavior. The vulnerability research, root cause analysis, and original exploitation technique belong to the original researchers.
Again, props and credit to: