CVE-2026-31431 Copy Fail Privilege Escalation

mahmoud halim@mhalim321

•updated Apr 30, 2026•47•3•2,366

Detects exploitation of CVE-2026-31431 (Copy Fail), a logic flaw in the Linux kernel AF_ALG crypto interface that allows an unprivileged user to overwrite the page cache of read-only files, including SUID binaries such as /usr/bin/su, without holding write permissions. By injecting a payload into the page cache of a SUID binary and executing it, an attacker gains root privileges.