Spencer McIntyre
Source-scoped identity with 87 associated PoCs and 98 linked vulnerabilities.
Exploit catalog results
Showing 25 PoCs on this page
MetasploitCopy Fail AF_ALG + authencesn Page-Cache Write
Metasploit exploitby Diego Ledda, plus 2 additional contributorsAdded to Metasploit 2026-04-30ExploitCVE-2026-314311 file
Analysis
Technical assessment
This is a Metasploit local exploit module for CVE-2026-31431. It leverages a kernel logic flaw to perform a controlled 4-byte write into the page cache of a readable file, enabling privilege escalation by injecting shellcode into a setuid-root binary. The module includes a check method that runs a Python-based vulnerability scanner and attempts to execute 'id' to confirm root access, and an exploit method that generates an ELF payload, compresses and encodes it, and passes it to a Python exploit stub for execution.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a local privilege escalation exploit for CVE-2026-31431. It reads Python stubs from the framework's data directory, executes them on the target, and runs a user-supplied payload. No concealed executable behavior, credential theft, persistence mechanisms, or unrelated payloads were observed. The module's actions are consistent with its stated purpose.
ClassificationExploit
Model confidence100%
AuthenticationNot required
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The artifact is a Metasploit module of type 'exploit' that actively triggers CVE-2026-31431 to achieve local privilege escalation by writing a payload into the page cache of a setuid binary. The module's exploit method generates and delivers a payload to a Python exploit stub for execution, which is the defining characteristic of an exploit.
modules/exploits/linux/local/cve_2026_31431_copy_fail.rb:6modules/exploits/linux/local/cve_2026_31431_copy_fail.rb:109-111modules/exploits/linux/local/cve_2026_31431_copy_fail.rb:130-150Requirements
- Requires an existing Metasploit session on the target (shell or meterpreter).
modules/exploits/linux/local/cve_2026_31431_copy_fail.rb:41 - Target must be a vulnerable Linux kernel version (4.14 through unpatched versions).
modules/exploits/linux/local/cve_2026_31431_copy_fail.rb:19-25 - A Python interpreter (python, python3, python2.7, or python2) must be available on the target.
modules/exploits/linux/local/cve_2026_31431_copy_fail.rb:106 - Target architecture must be x64, aarch64, or armle.
modules/exploits/linux/local/cve_2026_31431_copy_fail.rb:133-135
Observed behavior
- The check method runs a Python vulnerability scanner (CVE-2026-31431-check.py) on the target. If the scanner reports success, it executes 'id' to verify root privileges.
modules/exploits/linux/local/cve_2026_31431_copy_fail.rb:69-102 - The exploit method generates a setuid ELF payload containing the attacker's command, compresses and base64-encodes it, and passes it to a Python exploit stub (CVE-2026-31431.py) that triggers the kernel vulnerability to write the payload into the page cache of a setuid binary.
modules/exploits/linux/local/cve_2026_31431_copy_fail.rb:130-150 - The cleanup method runs a Python cleanup stub (CVE-2026-31431-cleanup.py) to restore the modified setuid binary to its original behavior.
modules/exploits/linux/local/cve_2026_31431_copy_fail.rb:153-157
Behaviors behind the backdoor verdict
Observables
- File Read
- Payload withheldThe module reads a Python stub from the Metasploit data directory to perform a vulnerability check.
modules/exploits/linux/local/cve_2026_31431_copy_fail.rb:70 - File Read
- Payload withheldThe module reads the main exploit Python stub from the Metasploit data directory.
modules/exploits/linux/local/cve_2026_31431_copy_fail.rb:149 - File Read
- Payload withheldThe module reads a cleanup Python stub from the Metasploit data directory to restore the target binary.
modules/exploits/linux/local/cve_2026_31431_copy_fail.rb:156 - Command Execution
- Payload withheldThe exploit method executes the user-supplied payload on the target system.
modules/exploits/linux/local/cve_2026_31431_copy_fail.rb:110 - Command Execution
- Payload withheldThe check method runs 'id' to verify root-level code execution after the vulnerability check.
modules/exploits/linux/local/cve_2026_31431_copy_fail.rb:94 - Process Creation
- Payload withheldThe module executes Python stubs on the target by piping them to a Python interpreter.
modules/exploits/linux/local/cve_2026_31431_copy_fail.rb:124-127
What the analysis did not establish
- The Python exploit stubs (CVE-2026-31431.py, CVE-2026-31431-check.py, CVE-2026-31431-cleanup.py) are referenced but their source code is not included in the evidence, so the exact exploitation technique cannot be analyzed from this artifact alone.
- The analysis is based solely on the Metasploit module source and metadata; framework mixins, libraries, and external payloads are not expanded.
- The Python stubs (CVE-2026-31431-check.py, CVE-2026-31431.py, CVE-2026-31431-cleanup.py) are read from the Metasploit data directory but their contents are not included in the evidence. Their behavior cannot be verified.
- The evidence does not include the Metasploit framework mixins, libraries, or payloads used by the module (e.g., Msf::Exploit::Local, Msf::Payload::Python, framework.payloads). Their behavior is assumed to be standard.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.