CVE-2026-31431 (Copy Fail) Mitigation & Patch Script

Image Before Patch and Vulnerable

Image After Patch With Script

This repository contains a specialized bash script designed to mitigate and patch CVE-2026-31431, also known as "Copy Fail". This vulnerability is a critical Local Privilege Escalation (LPE) in the Linux Kernel that allows unprivileged users to gain root access by poisoning the Page Cache via the AF_ALG (Crypto API) and splice() system calls.

Vulnerability Overview

CVE-2026-31431 exploits a logic flaw in the kernel's cryptographic templates. By chaining specific syscalls, an attacker can overwrite the Page Cache of SUID binaries (like /usr/bin/su) in memory without altering the physical file on disk. This results in a "fileless" privilege escalation that is difficult to detect with traditional file integrity monitoring tools.

Affected Systems

• Linux Kernels (v4.10 up to v6.18.x)

• Major distributions including Kali Linux, Debian, Ubuntu, and RHEL.

Script Features

The patch_copy_fail.sh script provides a three-layered defense mechanism:

1. Immediate Workaround: Blacklists the af_alg and algif_aead modules to disable the exploit's primary communication vector.

2. Memory Sanitization: Flushes the system Page Cache (drop_caches) to remove any existing malicious payloads residing in RAM.

3. Permanent Remediation: Automates the update to the latest patched kernel version for Debian/Kali-based systems.

Usage

[!CAUTION] Always audit scripts before running them with root privileges.

1. Clone the repository:

   root@kitploit:~

   git clone https://github.com/xsanflip/CVE-2026-31431-Patch.git
   cd CVE-2026-31431-Patch
   
   

2. Make the script executable:

   root@kitploit:~

   chmod +x patch_copy_fail.sh
   
   

3. Run the script with sudo:

   root@kitploit:~

   sudo ./patch_copy_fail.sh
   
   

4. Reboot: A system reboot is required to initialize the new, patched kernel.

Technical Details

The script performs the following actions:

• Creates /etc/modprobe.d/blacklist-copyfail.conf.

• Executes sync and echo 3 > /proc/sys/vm/drop_caches.

• Runs apt update && apt install for the generic linux-image.

Disclaimer

This script is provided "as is" for educational and system administration purposes. The author is not responsible for any misuse or damage caused by this script. Always test in a staging environment before deploying to production.

Author: XsanLahci

Date: April 2026