🧬 ROSN-LR5 – Kernel LPE PoC & Mitigation Toolkit (CVE-2026-31431)

Offensive and defensive tool for the CVE-2026-31431 vulnerability on Linux systems.
It combines a local privilege escalation (LPE) proof of concept with utilities to review and temporarily mitigate the AF_ALG-based attack vector.

⚖️ EXCLUSIVE ETHICAL USE: This software is distributed solely for educational and security auditing purposes. It should only be run on systems you own or have explicit authorization to test. The author is not responsible for misuse.

✳️ Features

🔥 LPE Exploitation

• Complete PoC that escalates privileges to root by manipulating the AF_ALG socket.
• Payload injection with os.splice() and zlib decompression over /usr/bin/su.
• Persistent root shell once the exploit completes.

🛡️ Mitigation

• System state review:
  • Availability and loading of the algif_aead module.
  • Presence of the lock file at /etc/modprobe.d/disable-algif.conf.
  • OS and kernel information.
• Applying temporary mitigation (requires root):
  • Creates the lock file install algif_aead /bin/false.
  • Attempts to unload the module with rmmod.
  • Containment while the official kernel patch is applied.
• Removing the mitigation (requires root):
  • Deletes the lock file to restore normal module loading.

🔍 Privilege auditing

• Displays UID, user, groups, and membership in sudo or wheel.

🧪 Requirements

• Operating system: Linux (any distribution with a potentially vulnerable kernel).
• Python: 3.8 or higher.
• Permissions:
  • Exploitation: only requires read access to /usr/bin/su.
  • Mitigation (apply/remove): requires root (sudo).

📦 Installation

Clone the repository and enter the directory:

git clone https://github.com/ROSNLR5/MitigationToolkit-ROSN-LR5-Full.git
cd MitigationToolkit-ROSN-LR5-Full
chmod +x rosnlr5_full.py

🚀 Usage

Run the script with Python 3:

python3 rosnlr5_full.py

The main menu offers four options:

1. Audit user privileges – basic information about the current session.
2. Run ROOT exploit (CVE-2026-31431) – launches the escalation PoC.
3. Mitigation tools – submenu with review, apply, and remove mitigation.
4. About – credits and tool description.

🔧 Mitigation submenu

Inside option 3 you will find:

• Review system state – shows whether the algif_aead module is available/loaded and whether the lock file exists.
• Apply temporary mitigation – creates /etc/modprobe.d/disable-algif.conf and unloads the module. Requires sudo.
• Remove temporary mitigation – deletes the lock file. Requires sudo.
• Return to main menu.

⚠️ Important note about the mitigation

The temporary mitigation does not replace a kernel patch. It only blocks the loading of the vulnerable module while the system is updated.
After applying the mitigation, it is recommended to update the kernel with the official patches from your distribution.

👤 Credits

• Original vulnerability research and base PoC: Copyfile
• Script development and expansion with mitigation tools: ROSNLR5

📜 License

This project is distributed without an explicit license. The code is provided "as is", without warranties. Use is at your own risk and you must comply with local laws.

ROSN LR5 – understanding and containing CVE 2026 31431