gagaltotal/cve-2026-31431-copy-failAutomated scanner and patch helper for CVE-2026-31431, detecting vulnerable Linux hosts via SSH, verifying kernel versions, and applying kernel upgrades or temporary mitigations across multiple distributions.
Copy Fail is an automated security scanner and patch helper for detecting and remediating the CVE-2026-31431 vulnerability (Linux Kernel algif_aead Local Privilege Escalation) across your Linux infrastructure.
CVE-2026-31431 is a Local Privilege Escalation (LPE) vulnerability in the Linux kernel module algif_aead (Asynchronous Cipher Interface for AEAD). This vulnerability allows local users to escalate privileges to root level.
This tool helps you:
Note: This tool is intended solely for internal audit and patching purposes by sysadmins. Use it only on systems you own or are authorized to access.
algif_aead module (loaded/not loaded)Automatically upgrade the kernel on vulnerable hosts via the package manager:
Option: Automatic reboot after patching is complete
algif_aead module via modprobe.d configurationDatabase of patched kernel versions for:
paramiko>=3.0.0 # SSH library
rich>=13.0.0 # Beautiful terminal UI
git clone https://github.com/gagaltotal/cve-2026-31431-copy-fail.git
cd cve-2026-31431-copy-fail
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
or install manually:
pip install paramiko>=3.0.0 rich>=13.0.0
python3 copyfail_scanner.py --help
# Scan subnet with SSH key
python3 copyfail_scanner.py --subnet <CIDR> --user <USERNAME> --key <PATH_TO_KEY>
# Scan multiple specific hosts
python3 copyfail_scanner.py --hosts <IP1>,<IP2>,<IP3> --user <USERNAME> [--password <PASSWORD>]
# Scan + automatic patch
python3 copyfail_scanner.py --subnet <CIDR> --user <USERNAME> --key <PATH> --patch
# Scan + temporary mitigation
python3 copyfail_scanner.py --subnet <CIDR> --user <USERNAME> --key <PATH> --mitigate
| Option | Description | Example |
|---|---|---|
--subnet | Target subnet CIDR (mutually exclusive with --hosts) | --subnet 192.168.1.0/24 |
--hosts | Comma-separated IP list (mutually exclusive with --subnet) | --hosts 192.168.1.10,192.168.1.20 |
--user | SSH username (required) | --user root |
--password | SSH password (optional, use if no key) | --password secret123 |
--key | SSH private key path | --key ~/.ssh/id_rsa |
--port | SSH port (default: 22) | --port 2222 |
--threads | Number of parallel threads (default: 30) | --threads 50 |
--patch | Automatically upgrade kernel on vulnerable hosts | --patch |
--reboot | Automatic reboot after patching (use with --patch) | --patch --reboot |
--mitigate | Apply temporary mitigation (disable algif_aead) | --mitigate |
--output | Export scan results to a JSON file | --output results.json |
--yes | Skip confirmation prompt before patch/mitigate | --yes |
python3 copyfail_scanner.py \
--subnet 192.168.1.0/24 \
--user ubuntu \
--key ~/.ssh/id_rsa
Output: Displays the scan results table and summary
python3 copyfail_scanner.py \
--hosts 10.0.1.5,10.0.1.6,10.0.1.7 \
--user admin \
--password my_password123
python3 copyfail_scanner.py \
--subnet 172.16.0.0/16 \
--user root \
--key ~/.ssh/id_rsa \
--mitigate
Action: Scan all hosts, then disable the algif_aead module on vulnerable hosts (prompts for confirmation)
python3 copyfail_scanner.py \
--subnet 192.168.0.0/24 \
--user ubuntu \
--key ~/.ssh/id_rsa \
--patch
Action: Upgrade the kernel, but do not reboot automatically (requires manual reboot)
python3 copyfail_scanner.py \
--subnet 10.10.0.0/24 \
--user root \
--key ~/.ssh/id_rsa \
--patch \
--reboot \
--yes
Action: Scan, patch the kernel, reboot automatically, skip confirmation
python3 copyfail_scanner.py \
--subnet 192.168.1.0/24 \
--user sysadmin \
--key ~/.ssh/id_rsa \
--output scan_results_$(date +%Y%m%d_%H%M%S).json
Output: Table in the terminal + JSON results in a file
python3 copyfail_scanner.py \
--subnet 10.0.0.0/25 \
--user ubuntu \
--key ~/.ssh/id_rsa \
--port 2222 \
--threads 50
Example output from a scan:
┏━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━━┓
┃ IP ┃ Hostname ┃ Distro ┃ Kernel ┃ algif ┃ Status ┃ Action ┃ Notes ┃
┣━━━━━━━━━━━━━━━╋━━━━━━━━━━━━━━━━╋━━━━━━━━━━━━━━━╋━━━━━━━━━━━━━━━╋━━━━━━━━━╋━━━━━━━━━╋━━━━━━━━━╋━━━━━━━━━┫
┃ 192.168.1.10 ┃ web-01 ┃ Ubuntu 22.04 ┃ 6.8.0-60 ┃ LOADED ┃ ✓ SAFE ┃ - ┃ Patched ┃
┃ 192.168.1.11 ┃ web-02 ┃ Ubuntu 20.04 ┃ 5.4.0-200 ┃ NOT_LDD ┃ ✗ VULN ┃ Patched ┃ - ┃
┃ 192.168.1.12 ┃ db-01 ┃ RHEL 8.9 ┃ 5.14.0-560 ┃ LOADED ┃ ? UNKNO ┃ - ┃ Distro ┃
┗━━━━━━━━━━━━━━━┻━━━━━━━━━━━━━━━━┻━━━━━━━━━━━━━━━┻━━━━━━━━━━━━━━━┻━━━━━━━━━┻━━━━━━━━━┻━━━━━━━━━┻━━━━━━━━━┛
Summary:
Total hosts scanned: 12
Accessible (SSH): 11
Offline: 1
VULNERABLE: 2
Already patched: 8
Unknown status: 1
hostname -funame -r){
"cve": "CVE-2026-31431",
"scan_time": "2026-05-08T15:30:45.123456",
"results": [
{
"ip": "192.168.1.10",
"ssh_reachable": true,
"auth_ok": true,
"hostname": "web-01",
"distro": "Ubuntu 22.04 LTS",
"os_id": "ubuntu",
"kernel_version": "6.8.0-60-generic",
"algif_loaded": true,
"modprobe_blocked": false,
"patched": true,
"patch_applied": false,
"mitigation_applied": false,
"retry_count": 0,
"error": ""
}
]
}
The scanner supports automatic detection for the following distributions:
| Distro | Package Manager | Patched Kernel Versions | Notes |
|---|---|---|---|
| Ubuntu | apt | 6.8.0-60, 5.15.0-130, 5.4.0-216 | LTS & current |
| Debian | apt | 6.1.137, 5.10.235 | Stable releases |
| RHEL | dnf/yum | 5.14.0-570 | Includes CentOS Stream |
| AlmaLinux | dnf | 5.14.0-570 | Drop-in RHEL replacement |
| Rocky | dnf | 5.14.0-570 | Enterprise-focused |
| Fedora | dnf | 6.14.4, 6.13.12, 6.12.25 | Cutting-edge |
| Amazon Linux | dnf | 6.1.134, 5.10.235, 4.14.353 | AWS compatibility |
| SUSE / openSUSE | zypper | 6.4.0-18, 5.14.21-150600.24 | Enterprise & community |
| Arch Linux | pacman | 6.14.4 | Bleeding edge |
For undetected distributions: Verify the kernel version manually. Kernels >= 6.14.4 are generally considered safe.
If you prefer manual patching or automatic patching fails, follow the per-distro guide:
sudo apt update
sudo apt upgrade linux-image-generic kmod
sudo reboot
sudo dnf clean metadata
sudo dnf upgrade kernel
sudo reboot
sudo dnf upgrade kernel
sudo reboot
sudo dnf upgrade kernel
sudo reboot
sudo zypper update kernel-default
sudo reboot
sudo pacman -Syu linux linux-headers
sudo reboot
If you cannot reboot immediately for a kernel upgrade, apply the mitigation:
# Disable the algif_aead module via modprobe.d
echo 'install algif_aead /bin/false' | sudo tee /etc/modprobe.d/disable-algif_aead.conf
# Unload the module if already loaded
sudo rmmod algif_aead 2>/dev/null || echo "Module not loaded"
IMPORTANT:
CONFIG_CRYPTO_USER_API_AEAD=y, the module is built into the kernel, so modprobe.d is ineffective → a kernel upgrade is the only solutionError: SSH port is not open
Solution:
nc -zv <IP> 22--port if SSH runs on a custom portError: SSH authentication failed
Solution:
chmod 600 ~/.ssh/id_rsassh -i ~/.ssh/id_rsa user@host--password if you prefer password authenticationExit code 1: dpkg: error processing...
Solution:
sudo visudoapt/dnf/yum without a password promptRetry: 3x | Host temporary unavailable
Solution:
--threads 10Status: ? UNKNOWN
Solution:
uname -r and compare with the advisoryExit code 1: Failed to lock apt database
Solution:
sudo tail -f /var/log/apt/term.logInternal Use Only — This tool is intended solely for audit and patch management purposes by authorized sysadmins.
DISCLAIMER:
- Use only on systems you own or have explicit authorization to access
- Automatic patching and reboots can cause downtime
- Test in a staging environment before production deployment
- Ensure backups are available before patching
- The developer is not responsible for data loss or service disruption
Author: GagalTotal
Repository: https://github.com/gagaltotal/cve-2026-31431-copy-fail
Contact: ghostgtr666
For bug reports, feature requests, or questions:
Last Updated: May 8, 2026
Scanner Version: 1.0