fulucky0-yuri/cve-2026-31431-poccC implementation of a proof-of-concept for CVE-2026-31431, a Linux kernel AF_ALG page cache poisoning vulnerability that enables local privilege escalation and potential container escape via SUID file pollution.
CVE-2026-31431 PoC reproduced in C, usable for exploitation when Python is not available on the target environment.
Vulnerability type: Linux kernel AF_ALG subsystem page cache poisoning, achieving local privilege escalation and possible container escape by poisoning SUID file contents.
Affected kernel versions: Linux kernel 5.15 ~ 6.1.x (some lower or higher versions may also be affected, depending on AF_ALG-related compile options).
Exploitation conditions:
The kernel is compiled with CONFIG_CRYPTO_USER_API_AEAD and supports AEAD algorithms (such as authenc(hmac(sha256),cbc(aes))), or the corresponding modules are loaded.
The attacker has a local low-privilege account and can execute arbitrary code (such as uploading a statically compiled ELF).
The target filesystem supports the splice system call.
You can directly upload the copy_fail file to the target machine and execute it, or you can choose to compile the copy_fail.c file yourself.
Static compilation is recommended (to avoid glibc version dependencies): gcc -static -o copy_fail copy_fail.c
./copy_fail
This code is rewritten based on the official Python PoC.
This code is intended solely for security research, education, and legally authorized testing. It is strictly prohibited for illegal attacks. Users shall bear all legal responsibilities themselves.
