Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cve-2026-31431 — Provides safe detection and kernel patch scripts for CVE-2026-31431, a Linux kernel privilege escalation via algif_aead. Includes read-only checks, module blacklisting, and kernel-only upgrades. | Kitploit
Tools/GitHubGitHub/mrhudson69/cve-2026-31431
Vulnerability Analysis
GitHubmrhudson69/cve-2026-31431

cve-2026-31431

Provides safe detection and kernel patch scripts for CVE-2026-31431, a Linux kernel privilege escalation via algif_aead. Includes read-only checks, module blacklisting, and kernel-only upgrades.

View Repository
3 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-31431 "Copy Fail" — Detection & Safe Kernel Patch Scripts

Linux kernel local privilege escalation via algif_aead (AF_ALG) CVSS 7.8 HIGH | Public disclosure: April 2026

⚡ Quick Start

1. Detection Script (safe, read-only)

Run as a normal user:

root@kitploit:~
curl -fsSL https://raw.githubusercontent.com/Mrhudson69/cve-2026-31431/main/check_cve_2026_31431.sh -o check.sh && bash check.sh

This script:

  • performs read-only checks only
  • does NOT modify the system
  • does NOT exploit the vulnerability
  • checks whether the algif_aead AEAD bind path is reachable

2. Patch / Mitigation Script

Run as root:

root@kitploit:~
curl -fsSL https://raw.githubusercontent.com/Mrhudson69/cve-2026-31431/main/patch_cve_2026_31431.sh -o patch.sh && sudo bash patch.sh

3. Elastic Agent Removal Script

Run as root if you want to remove Elastic Agent from the server:

root@kitploit:~
curl -fsSL https://raw.githubusercontent.com/Mrhudson69/cve-2026-31431/main/uninstall_elastic_agent.sh -o uninstall-elastic.sh && sudo bash uninstall-elastic.sh

This script:

  • finds the installed Elastic Agent binary
  • runs elastic-agent uninstall non-interactively
  • verifies whether the binary, service, and install directory were removed

🔥 Important: Containers / LXC / Docker

If you are inside:

  • Docker
  • LXC
  • Proxmox Container (CT)
  • Kubernetes Pod
  • wg-easy container
  • any containerized environment

You CANNOT patch the host kernel from inside the container.

The script detects containers automatically and exits safely.

You must run the patch script on:

  • the Proxmox HOST node
  • the actual Debian/Ubuntu VM host
  • the bare-metal Linux server

NOT inside the container.

🛡️ What is CVE-2026-31431?

A flaw in the Linux kernel algif_aead crypto interface allows an unprivileged local user to corrupt page cache contents through AF_ALG operations.

Under vulnerable kernel configurations, this may allow:

  • local privilege escalation
  • modification of page-cache-backed files
  • privilege escalation through writable cached binaries

The issue affects Linux kernel versions where the vulnerable AEAD optimization logic exists and is reachable.

✅ Supported Systems

OSVersions
Ubuntu20.04 / 22.04 / 24.04
Debian11 / 12 / 13
Proxmox VE6.x / 7.x / 8.x / 9.x
Generic LinuxAny distro using vulnerable kernels

📁 Scripts

check_cve_2026_31431.sh

Safe read-only detection script.

Checks performed

CheckDescription
Kernel VersionChecks vulnerable kernel range
Patch PresenceAttempts to identify patched kernel
algif_aead StatusChecks module load / blacklist state
AF_ALG SocketTests algif_aead AEAD bind reachability
Python os.spliceChecks pure-Python exploit feasibility
Setuid ExposureDetects common setuid targets
MitigationsChecks AppArmor / SELinux / seccomp

Safety

The detection script:

  • does NOT write files
  • does NOT modify kernel settings
  • does NOT install packages
  • does NOT execute exploit code

patch_cve_2026_31431.sh

Safe kernel-only mitigation + upgrade script.

Designed for:

  • production servers
  • Elasticsearch nodes
  • Nginx reverse proxies
  • database servers
  • Docker hosts
  • Proxmox nodes
  • AI/ML servers
  • monitoring infrastructure

uninstall_elastic_agent.sh

Safe helper script to uninstall Elastic Agent from a Linux server.

Designed for:

  • standalone Linux servers
  • Debian / Ubuntu hosts
  • Proxmox hosts
  • systems with Elastic Agent installed under /opt/Elastic/Agent

🔒 What the patch script does

1. Detects Environment

  • Ubuntu / Debian / Proxmox detection
  • container detection
  • kernel identification

2. Applies Immediate Mitigation

Creates:

root@kitploit:~
/etc/modprobe.d/cve-2026-31431-disable-algif-aead.conf

Contents:

root@kitploit:~
blacklist algif_aead
install algif_aead /bin/false

Then attempts:

root@kitploit:~
rmmod algif_aead

This blocks automatic loading of the vulnerable module.

The script also refreshes initramfs when update-initramfs is available so the blacklist survives reboot reliably.

3. Simulates Package Upgrade

Before upgrading anything, the script performs:

root@kitploit:~
apt-get -s install --only-upgrade ...

If ANY non-kernel packages would be upgraded:

  • Elasticsearch
  • Nginx
  • Docker
  • MSSQL
  • Redis
  • MongoDB
  • PostgreSQL
  • Kibana
  • etc.

the script ABORTS automatically.

This prevents accidental application upgrades.

4. Upgrades Kernel Packages ONLY

The script upgrades only:

  • Linux kernel packages
  • Proxmox kernel packages
  • kernel headers
  • initramfs/kernel support packages

No application/runtime packages are upgraded.

5. Resumes After Reboot

If the system reboots, the patch script now installs a temporary one-shot systemd service that re-runs the verification phase automatically on the next boot.

This lets a single script run cover:

  • immediate mitigation
  • kernel package installation
  • reboot
  • post-reboot verification

🧪 Dry Run Mode

Safest option first:

root@kitploit:~
sudo bash patch.sh --dry-run

This:

  • performs all checks
  • simulates upgrades
  • verifies package safety
  • makes NO system changes

Recommended before production deployment.

🔄 Reboot Options

No reboot

root@kitploit:~
sudo bash patch.sh --no-reboot

Immediate reboot

root@kitploit:~
sudo bash patch.sh --reboot-now

With --reboot-now, the script installs the reboot-resume hook before scheduling the restart.

Manual reboot later

root@kitploit:~
sudo reboot

If you use --no-reboot or reboot later manually, the post-reboot verification still resumes automatically on the next boot.

📋 Production Safety Notes

The script is designed to avoid touching:

  • Elasticsearch
  • Kibana
  • Logstash
  • Nginx
  • Apache
  • MySQL
  • MariaDB
  • PostgreSQL
  • MongoDB
  • Redis
  • MSSQL
  • RabbitMQ
  • Docker
  • NodeJS
  • Python runtimes
  • PHP
  • AI/ML workloads

However:

  • ALWAYS test in staging first
  • ALWAYS run --dry-run first
  • ALWAYS schedule maintenance windows for kernel reboots

📝 Logs

Patch logs:

root@kitploit:~
/var/log/cve_2026_31431_kernel_patch.log

🔍 Verification After Reboot

Check running kernel:

root@kitploit:~
uname -r

Run detection again:

root@kitploit:~
bash check.sh

Verify module blacklist:

root@kitploit:~
cat /etc/modprobe.d/cve-2026-31431-disable-algif-aead.conf

⚠️ Disclaimer

These scripts are provided for defensive security and system administration purposes only.

No exploit code is included.

Always:

  • review scripts before execution
  • test in non-production environments first
  • maintain backups/snapshots before kernel upgrades

Use at your own risk.

📜 License

MIT License

🔗 References

  • NVD CVE Entry https://nvd.nist.gov/vuln/detail/CVE-2026-31431

  • Linux Kernel Fix Commit https://git.kernel.org/linus/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5

  • Ubuntu Security Notices https://ubuntu.com/security

  • Debian Security Tracker https://security-tracker.debian.org/

Download Tool