v0.2.0

Cross-platform C port of CVE-2026-31431 (Copy Fail).

Discovery and disclosure: Theori / Xint, https://copy.fail/

Binaries

Each binary is statically linked. Download the one matching the
target's architecture, libc, and exploit variant.

Exploit variants:

• copy-fail-c-<arch>-<libc>: binary-mutation variant. Mutates
  a setuid binary's page cache, then execs it.
• copy-fail-c-passwd-<arch>-<libc>: /etc/passwd UID-flip variant.
  Mutates four bytes of /etc/passwd's page cache, then execs .
  Works where the binary-mutation route is blocked but has a
  narrower cashout surface; see README for details.

Detection (non-destructive):

• copy-fail-c-vulnerable-<arch>-<libc>: vulnerability checker.
  Creates a local testfile and runs the AF_ALG/splice primitive
  against its own page cache to detect kernel susceptibility,
  without touching any system file. Runs unprivileged. Exits 100
  if vulnerable, 0 otherwise.

Build modes:

• -glibc builds: GNU cross-toolchain, glibc-static. Larger (~800 KB)
  but functionally identical to source-built binaries on a glibc system.
• -musl builds: zig cc + musl-static. Smaller (~30-60 KB) and
  forward-compatible with any glibc version on the target.

Architectures: x86_64, aarch64, armv7, riscv64, ppc64le, s390x.

See README
for the kernel-version window of applicability and a description of
the exploit mechanism.