{"uuid": "c5235b5d-5a1f-4e6e-845b-8d191abf31b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2026_31431_copy_fail.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Xint Code\", \"rootsecdev\", \"Spencer McIntyre\", \"Diego Ledda\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"CVE-2026-31431 is a logic flaw in the Linux kernel's authencesn AEAD template that, when reached via the\\n          AF_ALG socket interface combined with splice(), allows an unprivileged local user to perform a controlled\\n          4-byte write into the page cache of any readable file. Because the corrupted pages are never marked dirty, the\\n          on-disk file is unchanged but the in-memory version is immediately visible system-wide, enabling local\\n          privilege escalation by injecting shellcode into the page cache of a setuid-root binary such as /usr/bin/su.\\n          The vulnerability was introduced by an in-place optimization in algif_aead.c (commit 72548b093ee3, 2017) and\\n          affects essentially all major Linux distributions shipped since then until the fix in commit a664bf3d603d.\", \"disclosure_date\": \"2026-04-29\", \"fullname\": \"exploit/linux/local/cve_2026_31431_copy_fail\", \"is_install_path\": true, \"mod_time\": \"2026-05-14 11:43:36 +0000\", \"name\": \"Copy Fail AF_ALG + authencesn Page-Cache Write\", \"needs_cleanup\": null, \"notes\": {\"AKA\": [\"Copy Fail\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/local/cve_2026_31431_copy_fail.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/local/cve_2026_31431_copy_fail\", \"references\": [\"CVE-2026-31431\", \"URL-https://copy.fail/\", \"URL-https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py\", \"URL-https://github.com/rootsecdev/cve_2026_31431\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Linux Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:07.347571Z"}