Detection toolkit for CopyFail(CVE-2026-31431)
Detection, mitigation, and IOC toolkit for Copy Fail CVE-2026-31431 Linux kernel page-cache privilege escalation - kadir/copy-fail-CVE-2026-31431-IOC
Opening excerpt (first ~120 words) tap to expand
copyfail-detect Detection toolkit for CVE-2026-31431 ("Copy Fail"), a Linux kernel local privilege escalation technique that corrupts page-cache data without changing the file on disk. Why This Exists Copy Fail can bypass traditional file integrity monitoring because the on-disk file is not modified. This repository provides layered detection using auditd, eBPF, page-cache comparison, Sigma rules, and responder documentation. The eBPF monitor is the highest-fidelity detector: it watches AF_ALG activity, extracts authencesn bind attempts, tracks suspicious splice() usage, and correlates those events into a high-confidence exploit-chain alert.
…
Excerpt limited to ~120 words for fair-use compliance. The full article is at GitHub.