CVE-2026-31431 (Copy Fail) Toolset

This repository contains detectors and PoCs for the Linux algif_aead / authencesn page-cache scratch-write vulnerability CVE-2026-31431.

Disclosure article: https://xint.io/blog/copy-fail-linux-distributions

Authorisation notice

Use only on hosts you own or have explicit authorisation to test. The detector is non-destructive and only operates on sentinel files in a temporary directory; the PoC and LPE modify in-memory page-cache state and constitute real local privilege escalation techniques — running them without authorisation is typically illegal.

Vulnerability overview

algif_aead performs AEAD operations in place, i.e. req->src == req->dst. When input data is fed from a regular file via splice(), the destination scatterlist contains references to that file's page-cache pages, allowing the kernel to write to the file's page-cache copy.

authencesn(hmac(sha256),cbc(aes)) performs a 4-byte scratch write to the seqno_lo field in the AAD (AAD bytes 4 through 7). Combined with the in-place AEAD and the splice() path described above, an attacker can cause these 4 bytes to land in a readable file's page-cache pages.

This modification is not written back to disk and only affects the current kernel page cache. The on-disk file content remains unchanged, but readers sharing that page cache will observe the corrupted content. World-readable files such as /etc/passwd and /usr/bin/su are potential targets.

File descriptions

Building release binaries

Requires a local Rust toolchain and Cargo.

Build all Rust binaries:

cargo build --release --bins

After building, the following are produced:

target/release/cve_2026_31431_detector
target/release/cve_2026_31431_poc

If precompiled binaries are to be committed to the repository, place them at:

dist/linux-x86_64/cve_2026_31431_detector
dist/linux-x86_64/cve_2026_31431_poc
dist/linux-x86_64/SHA256SUMS

Do not commit the entire target/ directory; it contains Cargo intermediate artifacts and local caches.

Build only the non-destructive detector:

cargo build --release --bin cve_2026_31431_detector

Build only the Rust version of poc.py:

cargo build --release --bin cve_2026_31431_poc

Checking whether the vulnerability is present

The Rust non-destructive detector is recommended:

./target/release/cve_2026_31431_detector
echo $?

It can also be run directly via Cargo:

cargo run --release --bin cve_2026_31431_detector
echo $?

Python detector usage:

python3 test_cve_2026_31431.py
echo $?

Exit code meanings:

Common output interpretation:

Operations performed by the detector:

1. Checks whether AF_ALG and authencesn(hmac(sha256),cbc(aes)) are available.
2. Creates a 4 KiB sentinel file in a temporary directory.
3. Sends the AAD via sendmsg, setting the AAD's seqno_lo to the marker PWND.
4. Feeds the sentinel file's page-cache page into the AF_ALG op socket via splice().
5. Calls recv() to drive algorithm execution.
6. Re-reads the sentinel file to check whether the marker or other modifications appear in the page cache.

The detector does not modify /usr/bin/su, /etc/passwd, or any other system files. The temporary sentinel file is deleted on exit.

Running the PoC

Rust version of poc.py:

./target/release/cve_2026_31431_poc

or:

cargo run --release --bin cve_2026_31431_poc

Note: following the logic of poc.py, this PoC opens /usr/bin/su, corrupts its page-cache copy via the vulnerability primitive, and then executes su. This is not part of the non-destructive detection flow and should only be run in an authorised test environment.

Python LPE usage

python3 exploit_cve_2026_31431.py
python3 exploit_cve_2026_31431.py --shell

This script locates the current user's UID field in /etc/passwd and attempts to change the UID in the page cache to 0000. The on-disk /etc/passwd is not modified, but system processes reading the page cache may observe the corrupted content.

Limitations:

• The current user's UID must be a 4-digit number, e.g. 1000 to 9999.
• NSS caching services such as nscd, sssd, and systemd-userdbd may mask page-cache changes to /etc/passwd.
• The /etc/passwd page cache must remain present between patching and executing su.

Clearing the page cache:

python3 -c "import os; fd=os.open('/etc/passwd', os.O_RDONLY); os.posix_fadvise(fd, 0, 0, os.POSIX_FADV_DONTNEED); os.close(fd)"

If a root shell has already been obtained, the following can also be run:

echo 3 > /proc/sys/vm/drop_caches

A reboot also clears the page-cache state.

Mitigation

Until the distribution kernel is patched, algif_aead can be disabled:

sudo tee /etc/modprobe.d/disable-algif-aead.conf <<<'install algif_aead /bin/false'
sudo rmmod algif_aead 2>/dev/null

After applying the mitigation, the detector should typically output 检测结论：未发现漏洞 and state that the trigger prerequisites are not met, with exit code 0.

The upstream fix approach is to restore AEAD operations from in-place to non-in-place processing, preventing page-cache pages from entering the writable destination scatterlist.

References

• Xint disclosure article: https://xint.io/blog/copy-fail-linux-distributions
• CVE-2026-31431