copyfail

Krnl Enhancer

copyFail for python pre 3.10, without os.splice()

Detection, mitigation, and IOC toolkit for Copy Fail CVE-2026-31431 Linux kernel page-cache privilege escalation

CopyFail (CVE-2026-31431): Linux kernel page-cache PrivEsc PoC + the only public detection tool. Novel PAM auth-bypass vector + Sigma/auditd/eBPF rules.

Responsive defense layer for Linux; ships kernel-LPE mitigations as 0days land. Coverage: Copy Fail family (cf1, cf2, Dirty Frag, Fragnesia, PinTheft, DirtyDecrypt) + FD-theft (ssh-keysign-pwn). EL7/8/9/10.

Copy Fail exploit (CVE-2026-31431) but in Rust.

Simple Ansible Playbook to mitigate against CopyFail (CVE-2026-31431) and DirtyFrag (CVE-2026-43284) vulnerabilities.

CVE-2026-31431 - Copy Fail | Linux LPE via authencesn page cache write. Unprivileged user to root on most distros since 2017. PoC in C and Python.

SELinux, IdM, and AAP proof of concept for confining privileged automation and denying kernel exploit surfaces before jobs reach managed RHEL hosts.

Portable read-only audit toolkit for the Q1-Q2 2026 Linux page-cache write LPE vulnerability cluster

Detects if any running pid uses AF_ALG, to help with https://copy.fail mitigations (seeing if its safe to turn off the AF_ALG module)

dirty patch for dirty CVEs

bpf-lsm module that blocks copyfail and dirtyfrag

More portable POC of copyfail LPE (CVE-2026-31431) that works on Alpine Linux

Password Recovery Tool Based on CopyFail and RedSun as Main Exploits

just me learning how this exploit worked

Embedded Device Toolkit - fetch static binaries for various architectures.

Exploit and detect CVE-2026-31431 vulnerabilities using a static binary that monitors system integrity and bypasses PAM authentication.