CVE-2026-31431 - Linux Kernel Privilege Escalation Exploit

Description

Functional exploit for the CVE-2026-31431 vulnerability that allows local privilege escalation on Linux systems by exploiting a flaw in the kernel's AF_ALG cryptographic subsystem combined with the splice() system call.

Features

• Full vulnerability verification before exploitation
• Multiple payloads for different targets (SUID binaries and /etc/passwd)
• Color interface with progress bar
• Optional page cache cleanup
• Non-persistent exploit (only modifies RAM)

Requirements

• Linux system with vulnerable kernel
• algif_aead module loaded
• authencesn algorithm available
• Python 3.x
• Execution permissions on the target system

Usage

python3 cve-2026-31431-poc.py

The script will automatically perform:

1. Vulnerability verification
2. Search for suitable SUID targets
3. Payload injection into the page cache
4. Execution of the modified binary to obtain root shell
5. Optional page cache cleanup

Warning

For use exclusively on systems with explicit authorization. This tool is designed solely for penetration testing on your own systems or those with explicit authorization.

Technical Details

The exploit works by:

1. Creating an AF_ALG socket with the authencesn algorithm
2. Configuring specific AEAD parameters
3. Using splice() to transfer pages from the page cache to the socket
4. Writing in-place to the target file's pages during the decryption process

Note

The modification only exists in the page cache (RAM) and is lost upon system reboot, automatically restoring the original binaries.