Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cve-2026-31431-checker — Detection tool for CVE-2026-31431 Copy Fail vulnerability in Linux kernels. Detection only - does not exploit. | Kitploit
Tools/GitHubGitHub/sibersan/cve-2026-31431-checker
Vulnerability ScannersVulnerability AnalysisConfiguration Auditing
GitHubsibersan/cve-2026-31431-checker

cve-2026-31431-checker

Detection tool for CVE-2026-31431 Copy Fail vulnerability in Linux kernels. Detection only - does not exploit.

View Repository
13 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-31431 (Copy Fail) Detection Tool

A comprehensive detection and analysis tool for CVE-2026-31431 "Copy Fail" vulnerability in Linux kernels.

⚠️ IMPORTANT DISCLAIMER

This tool is for DETECTION ONLY. It does not exploit or modify any system files.

  • Only reads system information and configuration files
  • Does not write to /etc/passwd, /usr/bin/su, or any system binaries
  • Does not perform actual exploitation attempts
  • Use only on systems you own and have permission to test

This tool may produce false positives or false negatives. Always use the official detector for definitive verification.

About CVE-2026-31431

CVE-2026-31431 "Copy Fail" is a critical Linux kernel vulnerability discovered by Taeyang Lee from Theori and analyzed by Xint Code Research. It affects most Linux distributions since 2017 and allows unprivileged local users to escalate privileges to root.

CVSS Score: 7.8 (High)
Affected: Linux kernels 4.13+ (August 2017) until April 2026 patches

What This Tool Does

  1. System Analysis: Collects kernel version, distribution, and architecture info
  2. Module Status Check: Verifies if algif_aead module is loaded and mitigated
  3. AF_ALG Reachability Test: Tests if vulnerable interfaces are accessible (non-destructive)
  4. Patch Verification: Analyzes kernel build dates and mitigation configurations
  5. Guidance: Provides instructions for running the official detector

Installation & Usage

root@kitploit:~
# Download
git clone https://github.com/sibersan/cve-2026-31431-checker
cd cve-2026-31431-checker

# Run (no root required, but sudo recommended for complete checks)
python3 cve_2026_31431_checker.py

Requirements: Python 3.6+ on Linux

Sample Output

root@kitploit:~
CVE-2026-31431 (Copy Fail) Detection Tool
Version 1.0.0  |  2026-05-01  |  Developed by: SiberSAN
Detection only — does not write to system files.

══ System Information ══
  • Hostname : webserver-01
  • Distro   : Ubuntu 22.04.5 LTS
  • Kernel   : 5.15.0-119-generic (x86_64)

══ SUMMARY REPORT ══
  Target    : webserver-01 (Ubuntu 22.04.5 LTS)
  Kernel    : 5.15.0-119-generic
  Date      : 2026-05-01T14:30:00
  Tool      : v1.0.0 — SiberSAN

  Result    : VULNERABLE / AT RISK
             - AF_ALG authencesn interface reachable
             - Uncertain about kernel patch status

Official Sources & Credits

This tool is based on research and guidance from:

  • Vulnerability Research: Theori/Xint Code
  • Official Detector: rootsecdev/cve_2026_31431
  • CERT-EU Advisory: 2026-005
  • Ubuntu Security: Copy Fail Advisory

Credit: CVE-2026-31431 was discovered by Taeyang Lee from Theori and analyzed by the Xint Code Research team.

Mitigation (If Vulnerable)

If the tool reports "VULNERABLE", apply immediate mitigation:

root@kitploit:~
# Disable the vulnerable module
echo -e 'blacklist algif_aead\ninstall algif_aead /bin/false' \
  | sudo tee /etc/modprobe.d/cve-2026-31431.conf
sudo rmmod algif_aead 2>/dev/null

# For RHEL/Enterprise kernels (if module is built-in)
sudo grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"
sudo reboot

Then update your kernel to the latest patched version.

Definitive Verification

Always use the official detector for final verification:

root@kitploit:~
git clone https://github.com/sibersan/cve-2026-31431-checker
cd cve_2026_31431
python3 test_cve_2026_31431.py

Exit codes: 0 = not vulnerable, 2 = vulnerable, 1 = test error

License

MIT License - see LICENSE file for details.

Contributing

  1. Fork the repository
  2. Create a feature branch (git checkout -b feature/improvement)
  3. Commit changes (git commit -am 'Add improvement')
  4. Push to branch (git push origin feature/improvement)
  5. Create Pull Request

Support

  • Check Issues for known problems
  • Always verify results with the official detector
  • For vulnerability questions, refer to the original research

Developed by SiberSAN | Detection Tool Only — Not an Exploit

Download Tool