mrmixies/copy-fail---cve-2026-31431Script Python pour verifier si un systeme Linux est vulnerable a la faille CVE-2026-31431 (Copy Fail), une elevation de privileges locale dans le noyau Linux.
Python script to check whether a Linux system is vulnerable to the CVE-2026-31431 (Copy Fail) flaw, a local privilege escalation in the Linux kernel.
Since 2017 (commit 72548b093ee3), the kernel's algif_aead cryptographic module has handled in-place operations incorrectly. Via splice(), an unprivileged user can corrupt the page cache of a setuid binary and obtain root privileges without touching the disk.
| # | Check |
|---|---|
| 1 | Kernel version (vulnerable range) |
| 2 | algif_aead module loaded or loadable |
| 3 | AF_ALG SOCK_SEQPACKET socket accessible without privileges |
| 4 | os.splice() available (direct Python exploit) |
| 5 | Setuid binaries readable by all (sudo, passwd...) |
| 6 | Active protections (SELinux, AppArmor, modprobe blacklist) |
python3 check_cve_2026_31431.py
No external dependencies. Works without root.
This script only analyzes the system. It does not exploit the flaw, does not load any module, and writes nothing to disk.
echo 'install algif_aead /bin/false' | sudo tee /etc/modprobe.d/algif_aead-block.conf
This workaround does not work on RHEL distributions (module built into the kernel).