Copy Fail (CVE-2026-31431): 9-year-old Linux kernel LPE found by Theori's Xint Code
Cross-platform C port of the Copy Fail Linux LPE (CVE-2026-31431). Disclosed 2026-04-29 by Theori / Xint.
PoC: fully unprivileged container escape to node-level code execution on Kubernetes via CVE-2026-31431 page-cache corruption + shared image layers. Validated on Alibaba Cloud ACK, Amazon EKS and Google GKE.
Minimal no-libc Linux x86_64 ELF PoC build for Copy Fail (CVE-2026-31431)
CVE-2026-31431 Copy Fail — Universal LPE exploit. Dynamic ELF offset + full-binary overwrite, Python 2/3 compatible with ctypes splice fallback
Rust implementation Exploit/PoC of CVE-2026-31431-Linux-Copy-Fail, allow executing customized shellcode (such as Meterpreter).
Copy Fail (CVE-2026-31431) LPE exploit. A clean, multi-arch Python reimplementation targeting the Linux kernel AF_ALG page cache vulnerability.
Detection, mitigation, and IOC toolkit for Copy Fail CVE-2026-31431 Linux kernel page-cache privilege escalation
Detection Only.. working on an exploit PoC
🛡️ Official AI Security Tool module for CVE-2026-31431 ("Copy Fail" / Linux algif_aead page-cache scratch-write LPE Exploit & Detector).
CopyFail (CVE-2026-31431): Linux kernel page-cache PrivEsc PoC + the only public detection tool. Novel PAM auth-bypass vector + Sigma/auditd/eBPF rules.
Responsive defense layer for Linux; ships kernel-LPE mitigations as 0days land. Coverage: Copy Fail family (cf1, cf2, Dirty Frag, Fragnesia, PinTheft, DirtyDecrypt) + FD-theft (ssh-keysign-pwn). EL7/8/9/10.
Copy Fail exploit (CVE-2026-31431) but in Rust.
Copy Fail -- CVE-2026-31431 - Hardened AF_ALG/splice page-cache mutation primitive for RedTeam Ops.
Golang port of copy-fail-cve-2026-31431
Runtime integrity guard: detect and block Linux page cache tampering (Copy Fail, Dirty Pipe, Dirty Frag) via O_DIRECT + fanotify. Includes 7 host-side exploitation PoCs.
CVE-2026-31431 Linux Local Privilege Escalation (LPE) Proof of Concept exploit