
Detection tool for CVE-2026-31431 Copy Fail vulnerability in Linux kernels. Detection only - does not exploit.
A comprehensive detection and analysis tool for CVE-2026-31431 "Copy Fail" vulnerability in Linux kernels.
This tool is for DETECTION ONLY. It does not exploit or modify any system files.
/etc/passwd, /usr/bin/su, or any system binariesThis tool may produce false positives or false negatives. Always use the official detector for definitive verification.
CVE-2026-31431 "Copy Fail" is a critical Linux kernel vulnerability discovered by Taeyang Lee from Theori and analyzed by Xint Code Research. It affects most Linux distributions since 2017 and allows unprivileged local users to escalate privileges to root.
CVSS Score: 7.8 (High)
Affected: Linux kernels 4.13+ (August 2017) until April 2026 patches
algif_aead module is loaded and mitigated# Download
git clone https://github.com/sibersan/cve-2026-31431-checker
cd cve-2026-31431-checker
# Run (no root required, but sudo recommended for complete checks)
python3 cve_2026_31431_checker.py
Requirements: Python 3.6+ on Linux
CVE-2026-31431 (Copy Fail) Detection Tool
Version 1.0.0 | 2026-05-01 | Developed by: SiberSAN
Detection only — does not write to system files.
══ System Information ══
• Hostname : webserver-01
• Distro : Ubuntu 22.04.5 LTS
• Kernel : 5.15.0-119-generic (x86_64)
══ SUMMARY REPORT ══
Target : webserver-01 (Ubuntu 22.04.5 LTS)
Kernel : 5.15.0-119-generic
Date : 2026-05-01T14:30:00
Tool : v1.0.0 — SiberSAN
Result : VULNERABLE / AT RISK
- AF_ALG authencesn interface reachable
- Uncertain about kernel patch status
This tool is based on research and guidance from:
Credit: CVE-2026-31431 was discovered by Taeyang Lee from Theori and analyzed by the Xint Code Research team.
If the tool reports "VULNERABLE", apply immediate mitigation:
# Disable the vulnerable module
echo -e 'blacklist algif_aead\ninstall algif_aead /bin/false' \
| sudo tee /etc/modprobe.d/cve-2026-31431.conf
sudo rmmod algif_aead 2>/dev/null
# For RHEL/Enterprise kernels (if module is built-in)
sudo grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"
sudo reboot
Then update your kernel to the latest patched version.
Always use the official detector for final verification:
git clone https://github.com/sibersan/cve-2026-31431-checker
cd cve_2026_31431
python3 test_cve_2026_31431.py
Exit codes: 0 = not vulnerable, 2 = vulnerable, 1 = test error
MIT License - see LICENSE file for details.
git checkout -b feature/improvement)git commit -am 'Add improvement')git push origin feature/improvement)Developed by SiberSAN | Detection Tool Only — Not an Exploit