CVE-2026-31431-mitigation

This repository holds the source code for our eBPF-based mitigation against CVE-2026-31431, also known as "copy.fail". (More info available at https://copy.fail)

The motivation behind building this solution was to fulfill the need for a reboot-less mitigation for mission-critical machines where algif_aead is built directly into the kernel, which makes it impossible to just blocklist the module for a quick mitigation.

This code is distributed AS-IS, without warranty of any kind, and licensed under the terms of the GPL-v2.0 license.

While we have tried this in our production servers, and it has been effective for us, we are presenting it only as a stop-gap solution.

Building

In order to build this, you'll need to install the BPF tools and headers for your kernel version. For example, on CloudLinux:

dnf install bpftool libbpf-devel clang llvm kernel-devel kernel-headers

YMMV on other distros.

Running

Once you have built the code in this repo, block_alg can take the following args:

• -l <log_path>: specifies which file to log blocked calls into
• -u <uid_list>: specifies which UIDs should be allowed to use AF_ALG. Format: 0,1000 -> allows UIDs 0 and 1000 to create AF_ALG sockets.