Copy Fail ARM64 Research (CVE-2026-31431)

Analysis and ARM64 reproduction of the Copy Fail Linux kernel privilege escalation vulnerability (CVE-2026-31431), originally disclosed by Xint.

Blog post: docs/post.md

What's Included

File	Description
`docs/post.md`	Blog post covering the vulnerability analysis and ARM64 porting process
`src/copy_fail_exp.py`	Original x86-64 PoC from Xint/Theori
`src/copy_fail_exp_readable.py`	Deobfuscated version of the above with comments and proper variable names
`src/shellcode_analysis.py`	Script to parse the payload ELF with `lief` and disassemble with `capstone`
`arm64_syscall/call.s`	ARM64 assembly for the shellcode (setuid + execve + exit)

What's Excluded

The following files are not included in this repository. They constitute the complete ARM64 exploit build chain and are withheld to avoid lowering the barrier for misuse. (Private gist)

ARM64 minimal ELF builder
Shellcode compression/hex extraction tool
Compiled ARM64 binary
Complete ARM64 exploit script with embedded payload

The blog post describes the construction approach in enough detail for a motivated researcher to reproduce the work independently.

Disclaimer

This repository is for educational and authorized security research only. Do not use any of this material on systems without explicit authorization.

copyfail-arm64

Most Popular