
Conceptual validation script for CVE-2026-31431 "Copy Fail" — a Linux kernel local privilege escalation via algif_aead page-cache write.
CVE-2026-31431 is a logic bug in the Linux kernel's authencesn AEAD template. When combined with AF_ALG and splice(), it allows an unprivileged local user to perform a controlled 4-byte write into the page cache of any readable file. A 732-byte Python script can obtain root on every major Linux distribution shipped since 2017.
https://www.hunt-benito.com/blog/copy-fail-cve-2026-31431-linux-kernel-page-cache-lpe/
This script checks vulnerability status only. It does NOT exploit the vulnerability.
python3 cve_2026_31431_check.py
For the real PoC, see: https://github.com/theori-io/copy-fail-CVE-2026-31431
os.splice)AF_ALG supportThis tool is provided for educational and authorized security research purposes only. You may only run it on systems you own or have explicit written authorization to test. Unauthorized use is illegal and unethical. Hunt-Benito Limited accepts no liability for misuse.