CVE-2026-31431 (Copy Fail) — Live Process Code Injection PoC

Demonstrates arbitrary code execution in a running process via page cache.

by @secinfosex

What it does:

1. Compiles a test binary: check() { return 42; } in an infinite loop
2. Launches the process
3. Waits for "check() = 42" output
4. Replaces check() with getpid() shellcode via Copy Fail page cache write
5. Waits for "check() = " output
6. Compares PID from output with actual process PID
7. Restores page cache (posix_fadvise DONTNEED)

Success: check() returns the real PID — a syscall executed by the kernel in the process context. Arbitrary code execution confirmed.

Requirements:

• Unpatched kernel with algif_aead module available
• gcc
• Root not required (but AF_ALG socket access needed)

Usage: python3 copy_fail_inject_poc.py