🔐 CVE-2026-31431 - Kernel Exploitation Research Framework

Modular framework for studying a Linux privilege escalation (LPE) vulnerability based on AF_ALG + Page Cache Injection techniques.

🎯 Objective

This project is designed for:

• Research of Linux kernel vulnerabilities
• Teaching real exploitation techniques (LPE)
• Running controlled cybersecurity labs

⚙️ What does this project do?

This framework implements a technique that allows:

• Modifying the in-memory content (page cache) of SUID binaries
• Altering their behavior at runtime
• Attempting to escalate privileges to root without modifying the binary on disk

🧠 How does the vulnerability work?

The exploitation is based on the combination of multiple kernel mechanisms:

1. AF_ALG (Linux Crypto API)

Allows interacting with cryptographic algorithms from user space through special sockets.

2. Manipulated sendmsg()

Specially crafted structures are sent to the kernel to trigger unexpected behavior.

3. splice()

Allows transferring data between file descriptors directly in kernel space (zero-copy).

4. Page Cache Injection

The in-memory content of files is modified without altering the file on disk.

✔️ Result: The binary executes modified code only in memory

🔥 Execution flow

1. Automatic system detection (kernel, mitigations)
2. SUID binary selection (e.g.: /usr/bin/su)
3. Payload loading
4. Splitting into 4-byte chunks
5. Injection using AF_ALG + splice()
6. Alteration of the binary's behavior
7. Execution of the modified binary in memory

🚀 Usage

Basic execution:

python3 main.py

Expected flow:

[+] Scanning system...
[+] Vulnerable kernel detected
[+] Target found: /usr/bin/su
[+] Injecting payload...
[+] Execution completed

📌 Requirements

• Potentially vulnerable Linux system
• Kernel without associated patches
• Support for:

/proc/crypto   → AF_ALG
splice syscall → kernel transfer

• Read permissions on SUID binaries

📁 Project structure

exploit/
 ├── core.py        # Exploitation engine
 ├── payloads.py    # Payload management
 ├── targets.py     # Target definitions
 └── detectors.py   # Vulnerability detection

modules/
 ├── logger.py      # Structured logging
 ├── stealth.py     # Anti-detection
 └── utils.py       # Utilities

main.py             # Entry point

⚠️ Limitations

• ❌ Not a universal exploit
• ❌ Dependent on exact kernel version
• ❌ Based on race conditions (non-deterministic)

It may fail if mitigations such as the following are present:

• SELinux (enforcing)
• AppArmor
• GRSecurity

🧪 Recommended usage

• Virtual machines
• Isolated labs
• Controlled testing environments

👨‍🏫 Educational usage

This framework allows teaching:

• Kernel exploitation
• Privilege escalation techniques (LPE)
• Page Cache attacks
• Race conditions
• Userland ↔ kernel interaction

⚠️ Disclaimer

This project is exclusively for:

• Education
• Research
• Controlled environments

❌ Do not use on systems without authorization.

📜 License

MIT License