# From Exploit Code to Production Detection: Building a CVE-2026-31431 (Copy Fail) detection with Agents

Unprivileged local user corrupts page cache of readable files via AF_ALG authencesn decrypt and splice(), patching setuid binaries to execute code as root.

- Payout: Real-world hack
- Severity: high
- Program: Linux kernel
- Credited: Datadog Security Labs
- Disclosed: 2026-05-28
- CVE: CVE-2026-31431
- Write-up quality: 8/10
- Original: https://securitylabs.datadoghq.com/articles/cve-2026-31431-copy-fail-exploit-detection-with-agents/
- Library page: https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-cve-2026-31431-copy-fail-exploit-detection-with-agents
- Tags: domain:desktop impact:privesc impact:rce kind:incident platform:threat-intel sev:high tech:linux technique:source-review vuln:memory-corruption vuln:privilege-escalation

**Target:** AF_ALG authencesn AEAD decrypt path via splice()
**Root cause:** The authencesn AEAD decrypt path writes back into its input buffer, which splice() has backed with the target file's page cache pages, corrupting cached file contents without any VFS write.
**Steps:**
1. Create AF_ALG socket, bind to `authencesn(hmac(sha256),cbc(aes))`, set ALG_SET_KEY and ALG_SET_AEAD_AUTHSIZE=4, call accept() for op socket.
2. Open target read-only (e.g. `/usr/bin/su`), create pipe, `splice(target_fd, pipe_wr, 4096, offset_src=offset)`.
3. `splice(pipe_rd, op_sock.fileno(), 4096)` to feed page cache pages into the crypto op.
4. Send crafted AEAD decrypt request with attacker-controlled IV/assoc data to trigger write-back into the spliced pages.
5. Repeat at chosen offsets to patch cached binary, then execute it to run attacker code as root.
**Exploitation:** Unprivileged process splices readable setuid binary page cache into AF_ALG authencesn decrypt; vulnerable decrypt writes attacker-controlled bytes back into those cached pages, patching the binary in memory only. Executing the setuid binary then runs attacker code as root. Rust variant patches /etc/pam.d/* to bypass auth.
**Escalation:** Crosses container boundaries when target file's page cache pages are shared with host/other workloads; also targets PAM configs for auth bypass.
**Insight:** Zero-copy splice() into kernel crypto sockets hands the kernel writable references to page cache pages; audit any kernel path that writes into splice-fed buffers, and note page-cache-only corruption evades mtime/inode integrity monitoring.