Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE_2026_31431 — Exploit for CVE-2026-31431, a Linux kernel page-cache write primitive enabling local privilege escalation and container escape via AF_ALG and splice(). | Kitploit
Tools/GitHubGitHub/mishl-dev/cve_2026_31431
Privilege EscalationExploit FrameworksVulnerability AnalysisExploitationContainer EscapeBinary Exploitation
GitHubmishl-dev/cve_2026_31431

CVE_2026_31431

Exploit for CVE-2026-31431, a Linux kernel page-cache write primitive enabling local privilege escalation and container escape via AF_ALG and splice().

View Repository
13 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-31431

Copy Fail – a 4‑byte page‑cache write primitive in the Linux kernel's authencesn AEAD template, exploitable via AF_ALG + splice().

CVE-2026-31431 is a deterministic, race‑free logic bug in the Linux kernel.
An unprivileged local user can overwrite 4 bytes in the page‑cache of any readable file.
The on‑disk file is never touched; only the in‑memory copy is modified.
Because the page cache is shared system‑wide (including across containers), this primitive can be used for:

  • Local Privilege Escalation (root)
  • Container Escape (page cache is shared with the host)

The vulnerability was discovered by Xint Code Research Team and disclosed in April 2026.
For the full technical breakdown, see Copy Fail: 732 Bytes to Root on Every Major Linux Distribution.

Download Tool