Tools

gmh5225/linux-kernel-debugger

Kernel hardware debugger module for dumping rootkit operations and inspecting kernel-level activity for malware analysis and reverse engineering.

idov31/silverseal

Linux post-exploitation framework with a UEFI bootkit that persistently and stealthily loads a Rust-based kernel module rootkit on modern Linux…

bombinisecurity/bombini

eBPF Security Monitoring and Sandboxing Agent Based on Aya

ymsniper/umbra

External read-only game overlay for Linux. Derived offsets, composed skeletons, optional kernel module for ptrace-independent memory reads and…

nurupo/rootkit

Linux kernel module that grants root privileges, hides processes/files, and protects itself from unloading, designed for educational purposes on…

spensercai/copy_fail

Rust exploit PoC for Linux kernel LPE CVE-2026-31431 (AF_ALG page-cache write) plus eBPF runtime defense blocking AF_ALG socket creation via LSM or…

webhosting4u/copy-fail_detect_and_mitigate_cve-2026-31431

Detects exposure to CVE-2026-31431 (Copy Fail) and optionally mitigates by disabling the vulnerable algif_aead kernel module, providing verdicts and…

vasyapokemon/cve-2026-31431

Research and detection toolkit for Linux kernel LPE CVE-2026-31431, including exploit analysis, YARA rules, auditd/Falco detection, patching guide,…

rippsec/cve-2026-31431-copy-fail

Comprehensive analysis of CVE-2026-31431, a Linux kernel LPE, including exploit methodology, detection scripts, YARA rules, auditd and Falco…

mlazzarotto/copy-fail-cve-2026-31431-mitigation-ansible-playbook

An Ansible Playbook to mitigate the vulnerability CVE-2026-31431 on RHEL-based and Debian-based OSes.

mahradbt/copyfail-mitigation

Ansible playbooks to audit and mitigate CVE-2026-31431 ("Copy Fail"), a local privilege escalation vulnerability in the Linux kernel's `algif_aead`…

kwilck/copyfail

Copy Fail (CVE-2026-31431) is a logic flaw in the Linux kernel's algif_aead module — part of the AF_ALG userspace crypto API. It was disclosed on…

joltcan/ansible-role-cve-2026-31431

Ansible role that applies and verifies the modprobe.d mitigation for CVE-2026-31431 by disabling the algif_aead kernel module, with safety checks for…

euriconicacio/copy-fail-cve-2026-31431-poc

Proof-of-concept exploit for CVE-2026-31431, a Linux kernel local privilege escalation vulnerability in the algif_aead module, enabling unprivileged…

codesource/copyfail-check

Shell script to detect CVE-2026-31431 (Copy Fail) exposure and mitigations on Linux systems: kernel check, module state, boot params, AF_ALG…

abdelkabirouadoukou/cve-2026-31431-analysis-and-fix

In-depth technical analysis of Linux kernel CVE-2026-31431 (Copy Fail), a local privilege escalation via AF_ALG in-place scatterlist bug, including…

mrhudson69/cve-2026-31431

Provides safe detection and kernel patch scripts for CVE-2026-31431, a Linux kernel privilege escalation via algif_aead. Includes read-only checks,…

u1tr0nex/cve-2026-31431-copyfail-lab

Lab testing documentation for CVE-2026-31431 (Copy Fail) Linux kernel LPE