CVE-2026-31431 (Copy Fail) Vulnerability Check Script

Vulnerability Overview

CVE-2026-31431 (Copy Fail) is a Linux kernel local privilege escalation vulnerability that exploits AF_ALG sockets (address family 38) combined with the splice() zero-copy system call to bypass file write permissions and tamper with the page cache, enabling modification of SUID binaries without write permission and subsequently gaining root privileges.

Attack Chain

socket(AF_ALG, SOCK_SEQPACKET, 0)        # Create AF_ALG socket
  -> bind(authesn(hmac(sha256),cbc(aes)))   # Bind AEAD encryption template
    -> sendmsg(AEAD operation)                        # Trigger kernel crypto path
      -> splice(-> target file)                      # Zero-copy write, bypassing permission checks
        -> Tamper with SUID files like /usr/bin/su          # Escalate to root

Affected Kernel Versions

Script Features

• Vulnerability Detection: Kernel version check + algif_aead four-state analysis + mitigation checks
• Intrusion Investigation: SUID page cache comparison + module load history + Shell history scan + system file integrity + log audit + container detection
• Remediation Recommendations: Three defense methods (modprobe.d / initcall_blacklist / kernel upgrade), with distribution-specific commands
• Incident Response: Automatically outputs a complete emergency response procedure when intrusion indicators are found

Quick Start

# Download the script
wget https://raw.githubusercontent.com/tangjie1/CVE-2026-31431-Check/main/cve-2026-31431-check.sh

# Grant execute permission and run (requires root)
chmod +x cve-2026-31431-check.sh
sudo ./cve-2026-31431-check.sh

# Non-interactive mode (for automation/CI)
sudo ./cve-2026-31431-check.sh --non-interactive

Check Item Description

Part 1: Vulnerability Detection [1/3]

Part 2: Intrusion Investigation [2/3]

Part 3: Remediation Recommendations [3/3]

Supported Systems

Ubuntu / Debian / Kali / CentOS / RHEL / Rocky / AlmaLinux / Fedora / openSUSE / Arch Linux / Alpine Linux

License

MIT License

Disclaimer

This tool is intended for security research and authorized penetration testing only. Users must ensure compliance with local laws and regulations and use it only on target systems for which they have obtained explicit authorization. The developer assumes no responsibility for any consequences of unauthorized use.