modrosnlr5

🧬 modrosnlr5 – Linux Kernel LPE PoC (CVE-2026-31431)

Proof-of-concept tool designed to validate the exploitation of the CVE-2026-31431 vulnerability on Linux systems.
The exploit leverages the kernel's AF_ALG socket interface to inject a payload and obtain a root shell from an unprivileged user session.

⚖️ Ethical and controlled use: This code is distributed exclusively for research, training, and authorized auditing purposes. It should only be run in environments where you have explicit permission.

✳️ Key features

• Pre-inspection of privileges: Automatic analysis of UID, GID, and membership in the sudo, wheel, and root groups.
• AF_ALG socket engineering: PoC that hijacks the execution flow of the su binary via os.splice and decompression through zlib.
• Interactive control: The keyboard allows aborting the operation at any time (ESC), adding a safety layer before the actual payload deployment.

🔬 Exploitation mechanism

1. Preparation and analysis
   The script examines the current user's identity, detects SUID binaries, and verifies the system configuration.
2. Payload delivery
   The payload is decompressed with zlib and injected into the target process's space by manipulating the socket's data flow.
3. Root escalation
   If the injection succeeds, a shell spawn with maximum privileges is forced, establishing a persistent session.

🔧 Requirements and execution

Dependencies

• Kernel Linux vulnerable to the CVE-2026-31431 family.
• Python ≥ 3.8.
• Read access to /usr/bin/su.

Command

python3 mod_rosnlr5.py

📘 Credits Original research and base PoC: copy.fail

Adaptation, automation, and repository development: ROSNLR5

modrosnlr5 – fundamentals of local escalation over AF_ALG