Agent skill · security · aradotso
copyfail-go-lpe
Go implementation of CVE-2026-31431 (CopyFail), a Linux local privilege escalation exploit targeting the AF_ALG iov_iter kernel vulnerability affecting kernels v4.14–April 2026.
Why this skill is useful
Includes a complete executable exploit for a specific kernel vulnerability that the AI cannot generate on its own.
What it needs
Requires binutils-aarch64-linux-gnu, binutils-arm-linux-gnueabihf, go, goreleaser, nasm, python3 installed locally. About 4k tokens when loaded. Last updated 2026-07-09. 70 stars on the source repository.
What this skill does
CopyFail Go (CVE-2026-31431) Skill by ara.so — Daily 2026 Skills collection. CopyFail Go is a static Go binary implementation of CVE-2026-31431, a straight-line logic flaw in the Linux kernel's AFALG AEAD scatterlist handling. Unlike race-condition LPEs, it requires no timing window or kernel-specific offsets — the same binary roots every affected Linux distribution shipped since 2017. Affected kernel range: Floor: torvalds/linux 72548b093ee3 — August 2017, v4.14 (AFALG ioviter rework) Ceiling: torvalds/linux a664bf3d603d — April 2026 (fix: separates source/destination scatterlists) Confirmed vulnerable at disclosure: Ubuntu, RHEL, SUSE, Amazon Linux, Debian stock cloud images. --- How It Works The exploit abuses the AFALG AEAD in-place optimization introduced in 2017, which allowed page-cache pages to be used as a writable crypto destination via splice. This enables writing arbitrary content to read-only file-backed pages — including setuid binaries like /usr/bin/su. CopyFail-Go patches /usr/bin/su in-place via the kernel primitive, spawns a root shell, then restores the original binary. --- Getting the Binary Download a prebuilt release from GitHub: --- CLI Usage Interactive Root Shell Run a Binary as Root Flags Flag Description ------ ------------- --backup <path> Path to save the original /usr/bin/su before patching --exec <path> Execute a binary as root instead of spawning interactive shell --- Verifying Kernel Vulnerability Check if commit a664bf3d603d (or its distro backport) is present: --- Building from Source Prerequisites Build Payloads Compare output hex strings to those embedded in main.go, or replace them with your compiled payloads. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/copyfail-go-lpe