🔴 CVE-2026-31431 — Copy Fail

Linux Kernel Local Privilege Escalation (LPE) — Defensive Research Repository

📖 Overview

Copy Fail (CVE-2026-31431) is a Local Privilege Escalation (LPE) vulnerability affecting the Linux kernel via controlled corruption of the page cache through the AF_ALG, splice() and authencesn mechanisms.

This repository aims to:

• document the internal mechanism of the vulnerability,
• explain the logical exploitation chain,
• present defensive impacts,
• propose detection strategies,
• provide mitigation measures,
• raise awareness about Linux kernel security.

⚠️ This project is strictly educational, defensive, and intended for security research.

📑 Table of Contents

• Overview
• Vulnerability Mechanism
• Attack Surface
• Lab Demonstration
• Detection & IOCs
• Mitigations
• Timeline
• References
• Legal Notice

🧪 Research Framework

All demonstrations presented in this repository were carried out in isolated, controlled laboratory environments.

No use on third-party systems without explicit permission is allowed.

🔍 Overview

🧠 Why This Vulnerability Matters

Comparable to:

• Dirty Cow (CVE-2016-5195)
• Dirty Pipe (CVE-2022-0847)
• Modern Page Cache Corruption Primitives

🧬 Simplified Chain View

User Space
    ↓
AF_ALG Socket
    ↓
splice()
    ↓
Page Cache Reference
    ↓
authencesn In-Place Write
    ↓
Controlled 4-Byte Overwrite
    ↓
execve()
    ↓
Privilege Escalation

⚙️ Vulnerability Mechanism

Technical Timeline

2011 → authencesn added to kernel
2015 → AF_ALG gets AEAD + splice() support
2017 → In-place optimization in algif_aead.c
2026 → Discovery and official patch

🔩 Involved Components

AF_ALG

Socket interface exposing cryptographic primitives of the Linux kernel to userspace.

splice()

Mechanism allowing page transfer without copy between file descriptors.

authencesn

AEAD IPsec ESN template using the destination buffer as temporary workspace.

🧨 Root Cause

The optimization introduced in algif_aead.c allowed direct chaining of page cache pages into the destination scatterlist via sg_chain().

Input SGL:   AAD || Ciphertext || Tag (page cache)
                                     ↑
Output SGL:  AAD || Ciphertext ------+

authencesn then writes directly into the page cache pages of the target file.

🎯 Attack Surface

🖥️ Affected Systems

🧪 Demonstration (Lab Only)

⚠️ Reserved for isolated test environments.

Pre-checks

uname -r
lsmod | grep algif_aead
python3 --version

Cloning the PoC

git clone https://github.com/theori-io/copy-fail-CVE-2026-31431.git
cd copy-fail-CVE-2026-31431

Execution

python3 copy_fail_exp.py

🛡️ Detection & IOCs

Auditd

auditctl -a always,exit -F arch=b64 -S socket -F a0=38 -k af_alg_socket
auditctl -a always,exit -F arch=b64 -S splice -k splice_monitor

Behavioral Detection

ps aux | awk '$1 == "root"'
ss -tlnp

Defensive Monitoring

• eBPF monitoring
• Falco
• Wazuh
• EDR memory inspection
• Page-cache anomaly detection

🛡️ Mitigation

Disable algif_aead

echo "install algif_aead /bin/false" | sudo tee /etc/modprobe.d/disable-algif-aead.conf
sudo rmmod algif_aead

Seccomp Restriction

{
  "defaultAction": "SCMP_ACT_ALLOW",
  "syscalls": [
    {
      "names": ["socket"],
      "action": "SCMP_ACT_ERRNO",
      "args": [
        { "index": 0, "value": 38, "op": "SCMP_CMP_EQ" }
      ]
    }
  ]
}

✅ Official Patch

The patch a664bf3d603d removes the vulnerable in-place operation in algif_aead.c.

sudo apt update && sudo apt upgrade
sudo reboot

📅 Timeline

🔗 References

📈 SEO / Keywords

linux kernel security, CVE-2026-31431, copy fail, page cache, AF_ALG, authencesn, linux LPE, kernel exploit, linux hardening, security research, dirty pipe, kernel mitigation

⚖️ Legal Notice

This repository is intended exclusively for:

• defensive research,
• authorized laboratories,
• cybersecurity education,
• Linux security analysis.

Any unauthorized use is illegal.

👤 Credits

Original Research

• theori.io
• Linux security research community

French-language Project

• @Maxime288

⭐ Support Linux Kernel Security Research

🛡️ Awareness • Mitigation • Defensive Research
🔁 Share the project with the cybersecurity community
⭐ Support Linux security research

---