Input "Copy Fail" vulnerability: Update your kernel! Do not trust other solutions!

[Bitpalast]

Regarding the latest disastrous Linux vulnerability, CVE-2026-31431, multiple sources recommend mitigating the issue by disabling the algif_aead module, e.g. by running
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf && rmmod algif_aead 2>/dev/null
Even the reknown Heise publishing company is missing an important point in „Copy Fail“: Linux-root in allen großen Distributionen mit 732 Byte Python

In many distributions, algif_aead is not a module, but built into your kernel. This makes the above command useless. For example all Hetzner Linux images have it built-in, but also images by many other vendors. To test, whether the module is available from the kernel, run
grep CONFIG_CRYPTO_USER_API_AEAD /boot/config-$(uname -r)
If the result ends with "=y", algif_aead is built-in.

You absolutely must update your Linux kernel to the latest version to mitigate the issue. It is not sufficient to disable the "module", because actually, on many systems it's not a module, but built into the kernel. This also requires a reboot after updating. Do not choose the seemingly easier paths. they won't help.

 

[Fede Marsell]

That's correct, but in those cases, you can disable it at startup:
grubby --update-kernel=$(grubby --default-kernel) --args="initcall_blacklist=algif_aead_init"
After restarting, verify that it's disabled:
cat /proc/cmdline
And try running the exploit:
python3 -c 'import socket; s = socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0); s.bind(("aead","authencesn(hmac(sha256),cbc(aes))")); print("algif_aead successfully loaded, mitigation not effective")'
This completely mitigates the vulnerability. However, the best option is always to update the kernel.

 

[Andreas Mause]

On my various Plesk servers, the module is only marked as loadable (=m). This should prevent anything "worse" from happening for now.

 

[JVG]

On my various Plesk servers, the module is only marked as loadable (=m). This should prevent anything "worse" from happening for now.

In both of my servers (Debain 12 & 13) this is too the output I get running Peter's command.

 

[JVG]

In both of my servers (Debain 12 & 13) this is too the output I get running Peter's command.

I tested with: Copy Fail — 732 Bytes to Root in a local test server and both OS are in fact vulnerable, the patch works ok so far.