copy-fail-python

A compact, zero-dependency Python proof-of-concept for Copy Fail (CVE-2026-31431), a Linux kernel local privilege escalation through AF_ALG and splice() that corrupts the page cache of a readable file such as /usr/bin/su.

This is a port of the Theori PoC with two practical changes: the splice() syscall is invoked via ctypes instead of C, making it run on Python 3.7+ with nothing to compile, and the payload spawns a /bin/bash root shell rather than /bin/sh.

Affected Kernels

Check yours with uname -r. The exploit targets roughly kernels 4.9 through 6.18; patched distro kernels may be unaffected even within those ranges.

Usage

Nothing to install: the exploit uses only the Python standard library. You need read access to the target binary (readable SUID binaries are the usual target) and a vulnerable kernel.

python3 copy_fail_exp.py /usr/bin/su

Expected output on a vulnerable host:

[*] target: /usr/bin/su
[*] AF_ALG socket opened
[*] splicing page cache of target...
[*] page cache corrupted
[*] spawning root shell...
# whoami
root

Real output varies by kernel and timing. If the shell doesn't appear, re-run it; timing-dependent cache corruption sometimes needs a second attempt.

Requirements

References

• Theori PoC and writeup
• CVE-2026-31431, NVD

Disclaimer

Authorized testing and education only. Do not run this on systems you do not own or have explicit permission to test.