What is this?
This repository is a technical writeup and proof-of-concept for CVE-2026-31431, a 9-year-old Linux kernel local privilege escalation (LPE) vulnerability found by Theori's AI vulnerability research tool, Xint Code.
This repository is a technical writeup and proof-of-concept for CVE-2026-31431, a 9-year-old Linux kernel local privilege escalation (LPE) vulnerability found by Theori's AI vulnerability research tool, Xint Code.Is this a maintained tool or a one-off exploit writeup?It's a one-time security research writeup paired with proof-of-concept exploit code for this specific CVE, not an ongoing library or tool.
It's a one-time security research writeup paired with proof-of-concept exploit code for this specific CVE, not an ongoing library or tool.How do I run the exploit?You clone the repo and build/run the included PoC against a target kernel that matches one of the versions documented in the tested distro table.
You clone the repo and build/run the included PoC against a target kernel that matches one of the versions documented in the tested distro table.Does it need a specific kernel version or distro to work?Yes, it was validated on four specific builds: Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16.
Yes, it was validated on four specific builds: Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16.Will the exploit work on any Linux kernel?No, it has only been confirmed against the four listed kernel builds (6.17.0-1007-aws, 6.18.8-9.213.amzn2023, 6.12.0-124.45.1.el101, 6.12.0-160000.9-default); other kernel versions may need adjustments or may not be vulnerable at all.
No, it has only been confirmed against the four listed kernel builds (6.17.0-1007-aws, 6.18.8-9.213.amzn2023, 6.12.0-124.45.1.el101, 6.12.0-160000.9-default); other kernel versions may need adjustments or may not be vulnerable at all.Who is this repo for?Security researchers, kernel engineers, and red teamers who want to study or reproduce a real-world Linux LPE bug rather than general developers.
Security researchers, kernel engineers, and red teamers who want to study or reproduce a real-world Linux LPE bug rather than general developers.What is Xint Code?Xint Code is Theori's AI-powered vulnerability research tool, credited with discovering this 9-year-old Linux kernel flaw.
Xint Code is Theori's AI-powered vulnerability research tool, credited with discovering this 9-year-old Linux kernel flaw.How old is the vulnerability behind CVE-2026-31431?According to the project description, the bug had existed undiscovered in the Linux kernel for about 9 years.
According to the project description, the bug had existed undiscovered in the Linux kernel for about 9 years.Which distros has the exploit been verified against?Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16, each on a specific kernel build listed in the README's version table.
Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16, each on a specific kernel build listed in the README's version table.What are similar projects?Claude-Red, dirtyfrag, ghostlock-app, exploitarium, Relapse-Exploit, ablation, Stuxnet, PayloadsAllTheThings
Claude-Red, dirtyfrag, ghostlock-app, exploitarium, Relapse-Exploit, ablation, Stuxnet, PayloadsAllTheThingsWhich topics is it in?privilege-escalation, linux-kernel, ethical-hacking, redteam, binary-analysis, security-research, ai-security, infosec, vulnerability, exploit, kernel, offensive-security
privilege-escalation, linux-kernel, ethical-hacking, redteam, binary-analysis, security-research, ai-security, infosec, vulnerability, exploit, kernel, offensive-security