CVE-2026-31431

GitHubCurated repository PoCExploitC++SecureWithUmer/CVE-2026-PoCs

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python exploit for CVE-2026-31431 that leverages a vulnerability in the Linux kernel's algif_aead interface to write arbitrary data into the page cache of any readable file, bypassing permissions. It includes a specific escalation mode that patches /etc/passwd to remove the root password and then executes 'su root'.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script for CVE-2026-31431. The script implements a page-cache write primitive via AF_ALG AEAD operations and provides a local privilege escalation path by modifying /etc/passwd in memory. All code is consistent with the described vulnerability exploitation; no concealed backdoor, unrelated payload, or operator-directed harm beyond the stated exploit behavior was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareLinux kernel
Attack typesprivilege_escalationarbitrary_write
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, self-contained Python script (exploit.py) that implements a vulnerability to achieve privilege escalation. The README explicitly describes it as an 'exploit' and the code performs actions to modify system state (page cache) and execute a shell with elevated privileges, which is the definition of an exploit.

Sndav-CVE-2026-31431-Advanced-Exploit-7621384/README.md:63Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:1-405

Requirements

  • Target file must be readable by the attacker.Sndav-CVE-2026-31431-Advanced-Exploit-7621384/README.md:18
  • The kernel must have CONFIG_CRYPTO_USER_API_AEAD enabled and the 'authencesn(hmac(sha256),cbc(aes))' algorithm available.Sndav-CVE-2026-31431-Advanced-Exploit-7621384/README.md:17
  • The target file must be at least (offset + data_length + 4) bytes in size.Sndav-CVE-2026-31431-Advanced-Exploit-7621384/README.md:127

Observed behavior

  • Opens an AF_ALG socket and configures it for AEAD decryption.Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:121-125
  • Sends attacker-controlled data as AAD via sendmsg, where the last 4 bytes are the value to be written.Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:128-129
  • Uses splice() to inject pages from the target file into the kernel's crypto scatterlist.Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:132-135
  • Triggers the decryption operation via recv(), causing the kernel to write the attacker's 4-byte value into the target file's page cache at a controlled offset.Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:140-141
  • In 'escalate' mode, patches the root line in /etc/passwd to remove the password and then executes 'su root'.Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:235-305Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:390-402
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Page-cache write primitive via AF_ALG AEAD decrypt with spliceThe exploit uses sendmsg with attacker-controlled AAD and splice to inject file pages into the crypto scatterlist, causing authencesn to write seqno_lo into the page cache before HMAC verification fails.Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:94-147
Exploit Behavior
Local privilege escalation via /etc/passwd page-cache modificationThe escalate_passwd function modifies the root password field in the page cache of /etc/passwd and then executes 'su root' to gain root access.Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:235-305Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:390-402
File Operation
Backup of /etc/passwd to /tmp/.passwd.bakThe script creates a backup of /etc/passwd before modification, which is a standard safety measure in PoC exploits.Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:243-245
Review boundaries

What the analysis did not establish

  • Evidence is limited to the two text files provided; no binary files were inspected.
  • The artifact's behavior is analyzed based on static code review; the code was not executed.
  • Only the two text files (README.md and exploit.py) were reviewed; no binary files were present in the evidence packet.
  • The review does not assess whether the exploit actually works or is safe to execute.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1