copy-fail-CVE-2026-31431-IOC

copyfail-detect is a detection toolkit designed to identify exploitation attempts of CVE-2026-31431, a local privilege escalation vulnerability in the Linux kernel that alters page-cache data without modifying the actual disk file. It features multiple detection layers, including real-time eBPF monitoring of suspicious activities, auditd rules for syscall tracking, and a page-cache comparison tool for post-exploitation analysis, enabling proactive defense and investigation against the vulnerability. The toolkit also provides mitigation scripts and documentation for responders to safely address incidents involving the Copy Fail exploit.