copy-fail-zig - Zig implementation of the Copy Fail Linux LPE (CVE

项目说明

Copy Fail (C) Zig implementation

Zig implementation of the 732 Byte proof of concept for the Copy Fail Linux LPE (C), which was disclosed by Theori / Xint on April 29th 2026
The writeup can be found at copy.fail.

This implementation has no runtime dependencies and can be run as a standalone binary.

Build

Building the exploit requires zig 0.16.0 or higher, which can be installed from ziglang.org.
To build the exploit, run the following command in the terminal:

Optionally, it can be cross-built for a different Target
e.g.

or with uncompressed payloads

Usage

either run the compiled binary or use zig to run it

The executable can be run with different commands:

run
first writes the provided data at the gi (default 0) to the executable at the provided path, then runs it.
After the execution is finished, the file is reset to its original state using posix_fadvise.

Example:

sudo
writes included shellcode to a suid binary and executes it to run a command as root.
The source code of the shellcode can be found in payloads/sudo.zig.
The first argument of the command must be the full path to the program as the shellcode does not search for the program to run.
After the execution is finished, the file is reset as in the run command.

Example:

modify
writes the provided data at the gi (default 0) to the file at the provided path, without executing it.
After the modification, the file is NOT reset. Use the reset command to reset it.

Example:

reset
resets the file at the provided path to its original state using posix_fadvise. This discards the cached page and will read the content from disk when accessed again.

Example:

is_
checks if the system is by creating a temporary file, writing test data to it, and reading it back to see if the data got corrupted.

Example:

help
prints the usage message.

Affected kernels (from copy-fail-c)

In between: every major distro kernel that didn't backport the fix.
Ubuntu, RHEL, SUSE, Amazon Linux, and Debian were all confirmed
in their stock cloud-image kernels at disclosure time. Distro-level
backports started rolling out around 2026-04-29 alongside the public
disclosure. To whether a target kernel is in-window, check whether
a664bf3d603d (or its distro-specific backport) is present in the kernel's
git log or the distro's changelog.

License and credits

Discovery and original disclosure of C: Theori / Xint.
Public writeup at copy.fail.

This zig implementation: Emmmmllll <>

The zig compiler and standard library: Zig Software Foundation on MIT terms <

The exploit and payload are published for security-research and
defensi purposes. Use against systems you do not own or have
explicit authorization to test is your problem, not the author's.

项目信息

开发语言：Zig

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Zig implementation of the Copy Fail Linux LPE (CVE-2026-31431) https://copy.fail for security-research and defensive-detection purposes展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。