Agent skill · security · aradotso
cve-2026-31431-copy-fail
Detector and proof-of-concept LPE toolkit for CVE-2026-31431 ("Copy Fail"), a Linux kernel algif_aead page-cache scratch-write vulnerability enabling local privilege escalation.
Why this skill is useful
Provides a complete Python toolkit with executable scripts for detecting and exploiting a specific Linux kernel vulnerability, enabling local privilege escalation.
What it needs
About 5k tokens when loaded. Last updated 2026-07-09. 70 stars on the source repository.
What this skill does
CVE-2026-31431 ("Copy Fail") Toolkit Skill by ara.so — Daily 2026 Skills collection. A Python toolkit for detecting and demonstrating CVE-2026-31431, a Linux kernel vulnerability where algifaead with authencesn(hmac(sha256),cbc(aes)) performs an in-place AEAD operation via splice(), writing into page-cache pages of regular files — enabling an unprivileged user to corrupt the kernel's in-memory view of /etc/passwd or other world-readable files for local privilege escalation. Authorization notice: Use only on systems you own or are explicitly engaged to assess. Running this on unauthorized systems is illegal in most jurisdictions. Affected Systems Linux kernels carrying commit 72548b093ee3 (in-place AEAD, 2017) without the upstream revert Confirmed affected: Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 14.3, SUSE 16 Installation No installation required. Pure Python 3.10+ stdlib — clone and run directly. Files File Purpose ------ --------- testcve202631431.py Non-destructive detector; operates only on a temp sentinel file exploitcve202631431.py LPE; flips UID to 0 in /etc/passwd page cache, then invokes su Key Commands Detector Exit codes: 0 — Not vulnerable (precondition not met or page cache intact) 1 — Test error 2 — Vulnerable (marker landed in spliced page) Exploit How the Vulnerability Works The authencesn algorithm writes bytes 4–7 of the AAD (seqnolo) into the destination scatterlist. When splice() is used, that destination is the page-cache page of the source file. The on-disk file is never modified. Core Detection Logic (from testcve202631431.py) LPE Pattern (from exploitcve202631431.py) Requirements for LPE Running user has a 4-digit UID (1000–9999) No NSS caching daemon masking /etc/passwd reads (nscd, sssd, systemd-userdbd) /etc/passwd page remains in cache between patch and su exec Reverting Page Cache Corruption The on-disk /etc/passwd is never modified. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/cve-2026-31431-copy-fail