update: cve content

Author: pullsec

cve/kernel/CVE-2026-31431.md

@@ -36,8 +36,7 @@ CVE-2026-31431 stands out because it is not a memory corruption bug.
 
 It directly provides a powerful primitive through a logic flaw.
 
-> [!WARNING]
-> That simplicity is exactly what makes it dangerous.
+That simplicity is exactly what makes it dangerous.
 
 ## Vulnerability Overview
 
@@ -66,7 +65,7 @@ flowchart LR
 
 Data is copied into memory, but validation is incomplete.
 
-This breaks isolation guarantees and allows writes into the page cache.
+This breaks isolation guarantees and allows unintended writes into the page cache.
 
 ```mermaid
 flowchart LR
@@ -76,6 +75,14 @@ flowchart LR
         --> D["File content corrupted"]
 ```
 
+Example (simplified):
+
+```c
+copy_from_user(page_cache_buffer, user_data, size);
+```
+
+If validation is incomplete, user-controlled data may end up modifying cached file content.
+
 ## Why Page Cache Matters
 
 The page cache stores file data in memory.
@@ -92,6 +99,8 @@ flowchart LR
         --> B
 ```
 
+This becomes critical when the cached file is later executed with elevated privileges.
+
 ## Exploitation Idea
 
 The exploit relies on controlling what gets written into the page cache.
@@ -111,6 +120,8 @@ Typical targets:
 - setuid binaries  
 - scripts executed with elevated privileges  
 
+This turns a logic flaw into a direct path to privilege escalation.
+
 ## Key Insight
 
 > [!IMPORTANT]