cj667113/oci-ansible-fix-cve-2026-31431Ansible playbook that automates remediation of CVE-2026-31431 (Copy Fail) on OCI Linux instances by installing updated kernel packages, rebooting, and verifying the fix across multiple distributions.
This playbook remediates CVE-2026-31431, also known as Copy Fail, on Linux instances in OCI.
CVE-2026-31431 is a local privilege escalation issue in the Linux kernel algif_aead implementation used by the AF_ALG userspace crypto API. This playbook applies the main remediation path: install an updated vendor kernel package and reboot the instance so it runs the fixed kernel.
References:
The first play runs locally in OCI Cloud Shell or another machine with the OCI CLI configured. It resolves the hard-coded OCI instance OCIDs into reachable Ansible hosts by reading each instance, finding its primary VNIC, and selecting either the private or public IP address based on prefer_public_ip.
The second play patches the resolved Linux hosts in parallel, subject to Ansible's configured forks limit:
uname -r.dnf or yum update for kernel* and kernel-uek*.apt-get --only-upgrade for installed Linux kernel packages.zypper patch --category security.After reboot, the playbook uses the target distribution's package and repository tools to validate the remediation:
rpm, checks pending kernel updates with dnf check-update or yum check-update, checks CVE advisory metadata with updateinfo, and searches the installed kernel package changelog.dpkg-query, checks pending kernel updates with an apt-get simulation, and searches the installed kernel package changelog.rpm, checks pending kernel updates with zypper list-updates, checks CVE patch metadata with zypper list-patches --cve, and searches the installed kernel package changelog.The hard pass/fail checks are that the host is running a package-managed kernel after reboot and that no kernel package updates remain pending from the configured repositories. CVE-specific advisory and changelog output is collected when the distro publishes that metadata.
At the end of the run, a localhost summary play reports:
The default output is a compact per-host summary. To also print the full raw verification data, add:
-e show_detailed_cve_evidence=true
ansible-playbook -i localhost, patch_cve_2026_31431.yml \
-e oci_region=us-ashburn-1 \
-e ansible_user=opc \
-e ansible_ssh_private_key_file=/path/to/private_key \
-e prefer_public_ip=false
Use prefer_public_ip=true when Cloud Shell or your Ansible control host must reach the instances through public IP addresses. Use prefer_public_ip=false when the control host has private network reachability.
The playbook disables strict SSH host key checking for the dynamically discovered targets so it can run non-interactively against newly resolved instance IPs.
A successful run should end with CVE-2026-31431 verification passed for all targets. The total summary prints one line per field, grouped under Host: ..., including the previous kernel, installed kernel after reboot, running kernel package such as kernel-uek-core-..., and CVE check: PASS. If verification fails because kernel updates are still available, confirm the host can reach the correct vendor security repositories and rerun the playbook.