ledlight33/copyfail-dfirInteractive DFIR walkthrough of CVE-2026-31431 (Copy Fail) - from SIEM alert to confirmed verdict. Real Volatility 3 commands, verified methodology.
An interactive, step-by-step forensic investigation walkthrough for the Copy Fail Linux kernel vulnerability (CVE-2026-31431).
Click through an incident response scenario, from SIEM alert to confirmed verdict, with the commands an analyst would really run and plain-language notes at every step.
Use the left and right arrow keys to move between steps. Every step can be linked directly, for example #step-5 jumps to the page cache analysis.
The guide is available in English and Greek. Use the EN | ΕΛ button in the title bar, or open the Greek version directly: ledlight33.github.io/copyfail-dfir/?lang=el. The choice is remembered, and a Greek browser opens in Greek by default.
Only the explanations are translated (instructions, findings, notes, questions, the checklist and the verdict). Commands, code and technical terms stay in English.
Ελληνική έκδοση: ledlight33.github.io/copyfail-dfir/?lang=el
linux.pagecache.Files, linux.pagecache.InodePages) used on the memory imageausearch, and exploit traces recovered with stringsEveryone posts about vulnerabilities. Very few people show how to investigate them.
Copy Fail is a page-cache-only attack: the on-disk file is never modified, so a powered-off disk image looks clean. Live and memory analysis shows the tampering. This walkthrough shows what a DFIR analyst would look for, in what order, and why.
Each step has an optional notes panel (toggle it in the title bar) with an explanation in plain words, why the step matters, a common mistake, a short list of terms, a "check yourself" question and links to sources.
The last screen of the walkthrough has a read-only checklist you can run on your own machine: kernel version, whether the vulnerable module is loaded, a cached-versus-disk comparison of every setuid file, a package-manager check on su, and a few log traces. It tells you what a hit means and what to do next. Open it directly: ledlight33.github.io/copyfail-dfir/#step-8
Never test by running the public exploit on a machine you care about. A clean result is a good sign, not proof, because the poisoned page can be evicted or lost on reboot.
Console output is illustrative: PIDs, hashes, addresses and timestamps are invented, and long tables are shortened. The commands, syscall numbers, plugin names and options, and attack mechanics were checked against primary sources (the Theori PoC and Xint write-up, NVD, CISA, the Volatility 3 source, vendor advisories). Every step links its sources, and the verdict screen lists them all.
Two things are worth knowing:
dd iflag=direct) follows the dual-path method described by rfxn. It was not lab-captured for this guide, and direct I/O support depends on the filesystem, so test it on yours.Found a mistake? Please open an issue.
Single-page HTML with React (via CDN). No build step, no dependencies: just open index.html.
🧪 Periodic Table of DFIR: 118 tools for Digital Forensics & Incident Response
Marino Bekios, MB Labs
MIT - © 2026 Marino Bekios, MB Labs