Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
wg.copyfail.patch — eBPF-based workaround for CVE-2026-31431 (Copy.Fail) that filters or kills AF_ALG socket creation to prevent local privilege escalation and container escape. | Kitploit
Tools/GitHubGitHub/wgnet/wg.copyfail.patch
Defensive ToolsVulnerability AnalysisExploitationSecurity Virtualization
GitHubwgnet/wg.copyfail.patch

wg.copyfail.patch

eBPF-based workaround for CVE-2026-31431 (Copy.Fail) that filters or kills AF_ALG socket creation to prevent local privilege escalation and container escape.

View Repository
2453 months agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-31431 aka Copy.Fail eBPF workaround

Why it matters

This CVE allows authorized user change cache copy of any readable file, which leads to Local Privilege Escalation (aka local root exploit), sandbox/container escape and other issues. It works by creating AF_ALG socket that is provided by algif* kernel modules.

Current well-known workaround recommends disabling algif_aead module, that is not possible if the module is built-in, like in Fedora Linux, Oracle Linux and others RHEL-based. Also, some upstreams are still missing the patch. It means your systems will be vulnerable until you patch your kernel.

Solution

This package provides you two eBPF programs:

  • ebpf-alg-socket-filter, which filters AF_ALG socket creation by eBPF/LSM kernel mechanism
  • ebpf-alg-socket-killer, which kills any program that creates AF_ALG socket

I recommend use first one IF you have eBPF LSM module enabled in your kernel. You can check it by calling

root@kitploit:~
cat /sys/kernel/security/lsm

and checking if bpf is there.

If you don't have eBPF LSM module, use second program, it's more rude but protects as well.

Building

  • Install clang, kernel-heders, libbpf-devel and bpftool
  • Copy vmlinux.h from your kernel headers
  • run build.sh build

Running

  • Run apply.sh load to load
  • Run apply.sh unload to unload
  • Run apply.sh status to check status
Download Tool