
C implementation for researching Copy Fail (CVE-2026-31431)
A minimal C reproduction for researching Copy Fail (CVE-2026-31431).
This repository contains a compact C implementation built around the Linux kernel AF_ALG interface for vulnerability research, behavior analysis, and controlled reproduction.
.
├── src/ # C source
├── dist/ # built binary artifacts
make
The resulting binary is ./dist/copyfail.
The program requires one input file path argument. For example:
./dist/copyfail "$(which su)"
<input_path> is opened read-only and used as the splice() source on each iteration, always starting from file offset . A common choice is a readable SUID-root ELF such as .
0/usr/bin/su