copyfail

copyFail for python pre 3.10, without os.splice()

Detection, mitigation, and IOC toolkit for Copy Fail CVE-2026-31431 Linux kernel page-cache privilege escalation

CopyFail (CVE-2026-31431): Linux kernel page-cache PrivEsc PoC + the only public detection tool. Novel PAM auth-bypass vector + Sigma/auditd/eBPF rules.

Copy Fail exploit (CVE-2026-31431) but in Rust.

Responsive defense layer for Linux; ships kernel-LPE mitigations as 0days land. Coverage: Copy Fail family (cf1, cf2, Dirty Frag, Fragnesia, PinTheft, DirtyDecrypt) + FD-theft (ssh-keysign-pwn). EL7/8/9/10.

Simple Ansible Playbook to mitigate against CopyFail (CVE-2026-31431) and DirtyFrag (CVE-2026-43284) vulnerabilities.

CVE-2026-31431 - Copy Fail | Linux LPE via authencesn page cache write. Unprivileged user to root on most distros since 2017. PoC in C and Python.

SELinux, IdM, and AAP proof of concept for confining privileged automation and denying kernel exploit surfaces before jobs reach managed RHEL hosts.

Portable read-only audit toolkit for the Q1-Q2 2026 Linux page-cache write LPE vulnerability cluster

Detects if any running pid uses AF_ALG, to help with https://copy.fail mitigations (seeing if its safe to turn off the AF_ALG module)

dirty patch for dirty CVEs

bpf-lsm module that blocks copyfail and dirtyfrag

More portable PoC of copyfail LPE (CVE-2026-31431) that works on Alpine Linux

Password Recovery Tool Based on CopyFail and RedSun as Main Exploits

just me learning how this exploit worked. contains an expanded python script of the POC showing how it works with written out functions instead of the compact obfuscated style POC

⭐️ Ansible Automation Platform Version 2026 | Ansible Automation | Zero-Cost Trial | Ansible Controller Agenthub Modules ⭐️

Embedded Device Toolkit - fetch static binaries for various architectures.

Exploit and detect CVE-2026-31431 vulnerabilities using a static binary that monitors system integrity and bypasses PAM authentication.