CVE-2026-31431 "Copy Fail" — Linux Kernel LPE Lab

Overview

This repository documents a complete lab investigation of CVE-2026-31431 (Copy Fail), a high-severity local privilege escalation (LPE) vulnerability in the Linux kernel's algif_aead cryptographic module, disclosed on April 29, 2026.

CVSS Score: 7.8 (High)
Test Kernel: 6.18.12+kali-amd64
Lab Date: May 11, 2026

File	Description
`CVE-2026-31431_Copy_Fail_Lab_Documentation_v2.md`	Full lab report with all steps and findings
`screenshots/`	Terminal screenshots from live lab testing
`test_cve_2026_31431.py`	Safe non-destructive vulnerability detector
`exploit_cve_2026_31431.py`	PoC exploit (for research reference only)

Key Findings

Kernel 6.18.12+kali-amd64 confirmed VULNERABLE
algif_aead auto-loads on demand — not present at rest
/etc/passwd page-cache overwrite escalated uid=1000 → uid=0
su kali failed (PAM re-validates via loginuid)
sudo -u root /bin/bash succeeded — root shell obtained
Zero on-disk trace — file-integrity monitoring bypassed
blacklist directive is insufficient — install /bin/false required
Mitigation confirmed effective via safe detector

Mitigation

echo "install algif_aead /bin/false" | sudo tee /etc/modprobe.d/disable-algif.conf
sudo rmmod algif_aead 2>/dev/null || true
modprobe -n -v algif_aead   # Verify: should show "install /bin/false"

Patched kernel versions: 6.18.22+ / 6.19.12+ / 7.0+

Disclaimer

This repository is for educational and defensive security research purposes only. All testing was performed on an isolated, researcher-owned virtual machine. Do not use any of these tools against systems you do not own or have explicit written authorization to test.

CVE-2026-31431-CopyFail-Lab

Most Popular