What it does

This skill provides a comprehensive, non-destructive diagnostic suite for detecting CVE-2026-31431 "Copy Fail". It audits Linux kernels (versions 4.10–6.14) for a critical page cache corruption vulnerability that allows unprivileged local privilege escalation via AF_ALG crypto sockets.

Why use this skill

Detecting "Copy Fail" manually is error-prone. Standard package scans often miss kernel config states or runtime mitigations. This skill performs a compound analysis of ten distinct vectors, including patch presence verification, algif_aead module status, and AF_ALG socket accessibility. It's better than manual prompting because it executes a standardized, multi-step investigative script that provides actionable intelligence and programmatic JSON output for SIEM or CI/CD integration.

Key Features

• Compound Verdicts: Correlates kernel versions with build info and runtime socket access to reduce false positives.
• Container & K8s Aware: Correctly identifies host kernel exposure when run inside a containerized environment.
• CI/CD Integration: Supports a headless mode with specific exit codes to gate deployments on vulnerable infrastructure.
• Remediation Guidance: Automatically provides context-specific mitigation steps based on whether the crypto module is built-in or loadable.

Supported Tools

The skill utilizes standard POSIX utilities, bash, and python3 (optional) to ensure compatibility across Ubuntu, Debian, RHEL, CentOS, Alpine, and generic Linux distributions.