Copy-Fail-CVE-2026-31431

A proof-of-concept exploit reproduction of the Linux kernel vulnerability CVE-2026-31431, also known as Copy Fail.

Credits to: Copy Fail

Affected Systems

• Linux kernel versions 4.14 and newer
• Most major distributions released from 2017 until patch deployment (Ubuntu, Debian, Fedora, RHEL...)

How This Differs from Original Exploit

Unminimized and Readable Code

• Original exploit code is compact
• This version is fully expanded

Backup and Restore Binaries

• Creates a backup of the target binary (e.g., /usr/bin/su)
• Verifies integrity via hashing
• Restores original state after execution (in case of success)

Proof of Concept

git clone https://github.com/MohamedKarrab/Copy-Fail-CVE-2026-31431.git
cd Copy-Fail-CVE-2026-31431

# targets /usr/bin/su by default
python fail.py

# or any setuid-root (passwd, mount, chsh, sudo, pkexec...)
python fail.py /usr/bin/passwd

Warning

In case of exploitation failure, the target binary may not be restored to its original state. Fix it by:

• Simply reboot the device. A reboot clears the page cache (the exploit does not modify the binary on disk).

• Alternatively, restore a clean /usr/bin/su (or the selected binary) from a trusted package. Debian / Ubuntu:

sudo apt-get install --reinstall util-linux

Fedora / RHEL:

sudo dnf reinstall util-linux

Arch:

sudo pacman -S util-linux

Technical Overview

This exploit abuses an AF_ALG AEAD implementation to write arbitrary 4-byte chunks into the kernel page cache of /usr/bin/su (a setuid-root binary).

• Uses unprivileged AF_ALG socket + crafted sendmsg/splice pairs to inject data into AES-CBC-HMAC processing
• Exploits a scatter/gather boundary bug to make decrypted AAD bytes land inside the cached binary
• Corrupts the in-memory .text section of /usr/bin/su without touching disk

Finally, executing /usr/bin/su loads the poisoned page cache, running injected code as root due to setuid.

Mitigation

• Update to patched kernel versions
• Block AF_ALG socket creation:

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf
rmmod algif_aead 2>/dev/null

Disclaimer

• This code is for educational and testing purposes only.
• Use only on systems you own or have explicit permission to test.
• I am not responsible for misuse or damages.

References

• NVD - CVE-2026-31431
• Copy Fail: 732 Bytes to Root