虽然我基本看不懂 write-up 在说什么，但发现这个 CopyFail 的人真的太帅了 https://xint.io/blog/copy-fail-linux-distributions#how-we-found-it-9

TLDR，十年 ctf 经验的韩国人 Taeyang Lee (https://0wn.kr/) 在今年初的 kernelCTF 工作上意识到 AF_ALG + splice 可能会有潜在的安全问题，这个直觉引导他和同事用 Xint (An AI-driven penetration testing platform) 在内核里搜索这种模式，prompt 很短：

This is the linux crypto/ subsystem. Please examine all codepaths reachable from userspace syscalls. Note one key observation: splice() can deliver page-cache references of read-only files (including setuid binaries) to crypto TX scatterlists.

Xint 找了一个小时找到了这个 bug。

太帅了，简直是新时代人类 AI 协作典范。

xint.io

Copy Fail: 732 Bytes to Root on Every Major Linux Distribution. - Xint

Xint Code disclosed CVE-2026-31431, an authencesn scratch-write bug chaining AF_ALG + splice() into a 4-byte page cache write. A 732-byte PoC gets root on Ubuntu, Amazon Linux, RHEL, SUSE. | AI for Security, Vulnerability Research