Copy-Fail-CVE-2026-31431-Kubernetes-PoC

Copy Fail is a proof-of-concept tool designed to demonstrate a method for fully unprivileged containers to achieve node-level code execution on Kubernetes by exploiting the CVE-2026-31431 Linux kernel vulnerability. It leverages the shared image layers in container runtimes, allowing an unprivileged pod to corrupt binaries in a shared layer that are later executed by privileged DaemonSets, thereby achieving container escape. Notable features include validation on multiple cloud platforms (Alibaba Cloud, Amazon EKS, and Google GKE) and a comprehensive breakdown of the attack chain, which includes page-cache corruption, cross-container propagation, and privileged execution.