Y5neKO/copy-fail-CVE-2026-31431-universal

GitHubRepository PoCExploitC

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains C and Python implementations of an exploit for CVE-2026-31431, a use-after-free vulnerability in the Linux kernel's AF_ALG AEAD subsystem. The code poisons the page cache of /usr/bin/su and replaces it with a payload that executes setuid(0) and spawns a root shell.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and two exploit implementations (C and Python) targeting CVE-2026-31431, a Linux kernel vulnerability in AF_ALG AEAD splice operations. The code performs the documented exploit behavior: poisoning the page cache of /usr/bin/su via a use-after-free to replace it with a minimal ELF payload that executes setuid(0) and spawns a shell. No concealed backdoor, unrelated payload, persistence mechanism, or operator-directed harm beyond the stated local privilege escalation is observed in the reviewed text.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesCPython
Target softwareLinux kernelcrypto/algif_aead
Attack typesuse-after-freeprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits CVE-2026-31431 to achieve privilege escalation. It does not merely detect the vulnerability; it performs a series of operations (socket creation, splice, page cache corruption) to replace a binary with attacker-controlled code and then executes it to gain a root shell. The README explicitly labels the files as 'exploit' and provides compilation and execution instructions.

README.md:1README.md:5-10exploit.c:1-6exploit-python3-8-10.py:1-6

Requirements

  • Local unprivileged user access to a vulnerable Linux kernel (versions 4.14 through 6.19.12, and 7.0-rc*) with the AF_ALG AEAD module available.README.md:1
  • Target binary /usr/bin/su must exist and be readable.exploit.c:163exploit-python3-8-10.py:122

Observed behavior

  • Opens /usr/bin/su for reading.exploit.c:163exploit-python3-8-10.py:122
  • Creates an AF_ALG AEAD socket bound to 'authencesn(hmac(sha256),cbc(aes))' and configures it with a crafted key, authsize=0, and DECRYPT operation.exploit.c:84-101exploit-python3-8-10.py:77-85
  • Sends a crafted message with AEAD control messages (ALG_SET_OP, ALG_SET_IV, ALG_SET_AEAD_ASSOCLEN) to the operation socket.exploit.c:107-141exploit-python3-8-10.py:92-102
  • Uses splice(2) to move data from the su file descriptor into the operation socket via a pipe, triggering the use-after-free to corrupt the page cache.exploit.c:143-150exploit-python3-8-10.py:104-109
  • Repeats the process in 4-byte chunks to overwrite the entire page cache of /usr/bin/su with a minimal ELF payload that calls setuid(0) and execve('/bin/sh').exploit.c:166-167exploit-python3-8-10.py:128-131
  • Executes /usr/bin/su, which now runs the injected payload, resulting in a root shell.exploit.c:172-173exploit-python3-8-10.py:135-136
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Target File
/usr/bin/suThe exploit targets /usr/bin/su for page cache poisoning and replacement with a setuid(0)+execve(/bin/sh) payload.exploit.c:4-5exploit-python3-8-10.py:5-6
Payload
Minimal ELF64: setuid(0) + execve("/bin/sh") + exit(0)The payload embedded in both exploits is a small ELF binary that sets the user ID to root and executes /bin/sh, consistent with a local privilege escalation proof-of-concept.exploit.c:39-51exploit-python3-8-10.py:62-69
Exploit Technique
AF_ALG AEAD splice use-after-freeBoth exploits use the same technique: creating an AF_ALG AEAD socket, setting up decryption with specific parameters, and using splice to trigger a use-after-free that corrupts the page cache of the target file.exploit.c:65-157exploit-python3-8-10.py:74-118
Review boundaries

What the analysis did not establish

  • Evidence includes two non-text media files (images) that were not analyzed; their content is not needed for classification.
  • One text file (likely a Makefile or similar) was omitted from the packet; its absence does not affect the classification of the provided exploit source code.
  • Two non-text media files (img/img.png, img/img_1.png) and one unclassified file (6 bytes) were present in the artifact but not analyzed; their content could theoretically contain hidden instructions or payloads, though the text files themselves show no backdoor.
  • The review is limited to static analysis of the provided source code; dynamic behavior or compiler-introduced artifacts are not assessed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1