mr-bv/copy-fail-cve-2026-31431-exploit-in-cC exploit for CVE-2026-31431, a Linux kernel page-cache corruption vulnerability in the AF_ALG AEAD path, using splice() to influence cached file contents.
Discovery and original disclosure of CVE-2026-31431: Theori / Xint. Public writeup: https://copy.fail/.
This program targets the Linux kernel’s AF_ALG AEAD path and attempts to trigger the “Copy Fail” page-cache corruption behavior described in public advisories. The code opens a chosen file, repeatedly processes 4-byte windows of an embedded payload, and uses kernel crypto plumbing plus splice() to influence the cached file contents in memory. After the loop finishes, it executes the target binary, relying on whatever state the page cache was left in.
gcc -static -o Copy-fail-CVE-2026-31431-Exploit-in-C Copy-fail-CVE-2026-31431.c -D_GNU_SOURCE
./Copy-fail-CVE-2026-31431-Exploit-in-C
