CVE-2026-31431 — "Copy Fail" Research Repository

A 100% reliable Linux local privilege escalation affecting every mainstream distribution since 2017.

One logic bug in authencesn, chained through AF_ALG and splice() into a 4-byte page-cache write — silently exploitable for nearly a decade.

⚠️ Disclaimer

All code and documentation in this repository is provided exclusively for authorized security research and educational purposes.

Running exploit code against systems you do not own or have explicit written authorization to test is illegal. By using this repository, you accept full responsibility for your actions.

Overview

Why Copy Fail is different

Repository Structure

.
├── README.md                          ← You are here
├── LICENSE                            ← MIT
├── .gitignore
├── docs/
│   ├── analysis-report.md             ← Comprehensive security analysis
│   ├── analysis-report.html           ← Styled HTML version
│   ├── exploit-walkthrough.md         ← Line-by-line PoC analysis
│   └── exploit-walkthrough.html       ← Styled HTML version
└── poc/
    ├── README.md                      ← PoC usage guide
    ├── copy_fail_exp.py               ← Official PoC (732 bytes, obfuscated)
    ├── copy_fail_exp_readable.py      ← Deobfuscated + annotated version
    ├── copy_fail_exp_compat.py        ← Python 3.6+ compat (ctypes splice)
    ├── copy_fail_exp_alpine.py        ← Alpine Linux variant
    ├── copy_fail_exp.c                ← C implementation (zero deps)
    ├── copy_fail_exp.go               ← Go implementation (zero deps)
    ├── copy_fail_rust/                ← Rust implementation
    │   ├── Cargo.toml
    │   └── src/main.rs
    ├── check_vulnerable.py            ← Vulnerability scanner
    └── mitigate.sh                    ← One-click mitigation script

Quick Start

Download pre-built release

# From GitHub Releases — pre-built binaries (Linux amd64/arm64) + all Python scripts
wget https://github.com/nisec-eric/cve-2026-31431/releases/latest/download/copy-fail-go-linux.tar.gz
wget https://github.com/nisec-eric/cve-2026-31431/releases/latest/download/copy-fail-c-linux.tar.gz
wget https://github.com/nisec-eric/cve-2026-31431/releases/latest/download/copy-fail-python.tar.gz

tar xzf copy-fail-go-linux.tar.gz
tar xzf copy-fail-c-linux.tar.gz
tar xzf copy-fail-python.tar.gz

# Go static binary (no Python needed)
chmod +x copy-fail-exp-amd64
./copy-fail-exp-amd64

# C static binary
chmod +x copy-fail-exp-c-amd64
./copy-fail-exp-c-amd64

# Or use Python scripts directly
python3 check_vulnerable.py

📦 Releases are auto-built via GitHub Actions on every v* tag push. Go and C binaries are built for linux/amd64 and linux/arm64 as static binaries.

1. Check if your system is vulnerable

python3 poc/check_vulnerable.py

2. Apply mitigation (no reboot required)

sudo bash poc/mitigate.sh

This blacklists the algif_aead kernel module — breaks nothing for 99% of systems.

3. Patch properly — upgrade your kernel

# Debian/Ubuntu
sudo apt update && sudo apt upgrade linux-image-*

# RHEL/CentOS/Fedora
sudo dnf update kernel

# Reboot into patched kernel
sudo reboot

4. Verify

python3 poc/check_vulnerable.py
# Exit code 1 = protected ✓

PoC Exploits

WARNING: Run only on systems you own or have authorization to test.

# C
gcc -static -o exp ./poc/copy_fail_exp.c && ./exp

# Python
python3 poc/copy_fail_exp.py
python3 poc/copy_fail_exp_compat.py        # Python < 3.10

# Go
go build -o exp ./poc/copy_fail_exp.go && ./exp

# Rust
cd poc/copy_fail_rust && cargo run --release

All versions accept an optional argument to target a different SUID binary:

python3 poc/copy_fail_exp.py /usr/bin/passwd
./exp /usr/bin/sudo

Documentation

📄 Security Analysis Report (HTML)

Full vulnerability assessment covering:

Technical root cause (scatterlist page provenance, authencesn scratch write)
Affected versions and distribution patch status
Remediation for bare-metal Linux, Kubernetes, Docker, WSL2
Detection and monitoring guidance (auditd, SELinux, file integrity)
Disclosure timeline

📄 Exploit Walkthrough (HTML)

Line-by-line PoC analysis covering:

Complete deobfuscated source with annotations
Kernel internals: AF_ALG socket flow, splice() page-cache delivery, sg_chain() mechanics
The authencesn ESN scratch write that crosses scatterlist boundaries
Payload analysis (160-byte ELF shellcode)
Attack variants: /etc/passwd injection, shared library targeting, container escape
Attack limitations and boundaries

Impact by Environment

Key References

copy.fail — Official vulnerability page
Xint Blog — Technical Writeup — Root cause deep-dive
NVD Entry
GitHub Advisory GHSA-2274-3hgr-wxv6
Kernel Patch (commit a664bf3d603d)
Official PoC Repository
Red Hat Advisory | Ubuntu | SUSE | Amazon Linux

Contributing

Contributions welcome:

Additional PoC implementations (Zig, etc.)
Distribution-specific test results
Detection rules (Snort, Suricata, YARA, Sigma)
Translations of documentation

Please open an issue or pull request.

License

MIT — Use responsibly.

CVE	CVE-2026-31431
Alias	Copy Fail
Type	Linux kernel local privilege escalation (LPE) / page-cache arbitrary write
CVSS v3.1	7.8 HIGH — `AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CWE	CWE-669 (Incorrect Resource Transfer Between Spheres)
Component	`crypto/algif_aead` — `authencesn` cryptographic template
Introduced	2017 (commit `72548b093ee3`)
Fixed	Mainline commit `a664bf3d603d` (2026-04-01)
Patched kernel	v6.18.22+, v6.19.12+, v7.0+
Discoverer	Xint / Theori (Taeyang Lee + Xint Code AI-assisted audit)
Disclosure	2026-04-29 — copy.fail

Race condition	Required	None
Per-distro offsets	Required	None
Reliability	30–80%	100%, single shot
Affected window	Narrow	2017 → 2026 (9 years)
On-disk modification	Possible	None (stealthy)
Cross-container	No	Yes

`copy_fail_exp.py`	Python 3.10+	stdlib only	Official 732-byte PoC
`copy_fail_exp_compat.py`	Python 3.6+	stdlib + ctypes	Works on CentOS 7, AL2 etc.
`copy_fail_exp_alpine.py`	Python 3.10+	stdlib only	Targets `/bin/ping` on Alpine
`copy_fail_exp.c`	C	gcc + Linux headers	Static binary, zero deps
`copy_fail_exp.go`	Go 1.21+	stdlib only	Static binary, zero deps
`copy_fail_rust/`	Rust 1.70+	libc + flate2 crates	Static binary

Multi-tenant Linux hosts	🔴 High	Any user → root
Kubernetes / containers	🔴 High	Shared page cache → container escape
CI runners (self-hosted)	🔴 High	Malicious PR → runner root
Cloud SaaS (user code)	🔴 High	Tenant → host root
Standard servers	🟡 Medium	Chains with web RCE / stolen creds
Single-user laptops	🟢 Low	Already the only user

cve-2026-31431

Most Popular