Detection toolkit for CopyFail(CVE-2026-31431)

copyfail-detect Detection toolkit for CVE-2026-31431 ("Copy Fail"), a Linux kernel local privilege escalation technique that corrupts page-cache data without changing the file on disk. Why This Exists Copy Fail can bypass traditional file integrity monitoring because the on-disk file is not modified. This repository provides layered detection using auditd, eBPF, page-cache comparison, Sigma rules, and responder documentation. The eBPF monitor is the highest-fidelity detector: it watches AF_ALG activity, extracts authencesn bind attempts, tracks suspicious splice() usage, and correlates those events into a high-confidence exploit-chain alert.

…

Excerpt limited to ~120 words for fair-use compliance. The full article is at GitHub.