CVE-2026-31431 check

Read-only checker for the algif_aead local-root vuln (CVE-2026-31431). Looks at kernel config, module state, AF_ALG socket reachability, and any mitigations you've put in place, then prints a verdict. It does not run exploit code.

Companion to dirty-frag-check (CVE-2026-43284 / CVE-2026-43500).

Heads up: this is a heuristic. A green verdict isn't a guarantee. Cross-reference with your distro's advisory before you call a host safe. MIT, no warranty.

Quick run

curl -fsSL https://github.com/haydenjames/CVE-2026-31431-check/releases/latest/download/cve-2026-31431.sh | bash

Read it first if you don't trust piping to bash:

curl -fsSLO https://github.com/haydenjames/CVE-2026-31431-check/releases/latest/download/cve-2026-31431.sh
less cve-2026-31431.sh
chmod +x cve-2026-31431.sh && ./cve-2026-31431.sh

Pin to a release tag for change control: https://raw.githubusercontent.com/haydenjames/CVE-2026-31431-check/v1.0.3/cve-2026-31431.sh.

-q for one-line fleet output. -h for help. Exit 0 ok, 1 vulnerable, 2 unknown.

Fleet usage

-q prints one line per host, so you can pipe it through whatever remote runner you already use:

# parallel-ssh
parallel-ssh -h hosts.txt -i 'bash -s -- -q' < cve-2026-31431.sh

# ansible
ansible all -m script -a "cve-2026-31431.sh -q"

Exit codes (0 ok, 1 vulnerable, 2 unknown) also work if your tooling aggregates by status.

Requirements

bash 4+, plus the usual awk/grep/sed/lsmod/modprobe. If python3 is around it'll also test AF_ALG socket reachability; if not, that check is skipped. The check itself doesn't need root. Applying the mitigation does.

What it checks

1. algif_aead state. Built-in, loadable module, loaded, or absent. Reads /boot/config-* or /proc/config.gz, falls back to lsmod. 1b. authencesn state. Per the upstream advisory, this is the module that actually contains the bug — algif_aead is one reach-in path, IPsec is another. Detected via lsmod/modinfo and config.
2. AF_ALG socket. Whether userspace can actually open one. Detects seccomp and LSM blocks (uses Python if available).
3. Mitigations. Looks for modprobe blacklist files (for either module) and verifies the blacklist actually wins via modprobe -n -v. Also flags the broken DefaultRestrictAddressFamilies systemd [Manager] trick that's been making the rounds — that directive only works on units, not in system.conf.d. Reports SELinux and AppArmor status.

Verdicts

• OK — AF_ALG isn't reachable, or the module isn't there, or your blacklist works.
• REBOOT NEEDED — patched kernel installed, you're still on the old one.
• VULNERABLE — module is loaded with no fixed kernel installed, or it's built into the kernel and there's a fixed package available.
• LIKELY PATCHED — module is loaded but the running kernel is up to date. The script can't introspect a loaded module to tell a fixed version from a vulnerable one, so this verdict defers to your package manager. Confirm against your distro's CVE tracker.
• AT RISK — module is loadable and nothing's stopping it.
• WAITING ON VENDOR PATCH — kernel is up to date but algif_aead is built in. Best-effort verdict; it leans on dnf check-update exit codes, which can be non-zero for unrelated reasons (network, stale metadata). Don't assume you're stuck waiting without checking your distro tracker.

Stopgap mitigation

Per the upstream advisory, the bug actually lives in the authencesn crypto module — algif_aead is just one of the reach-in paths. Blacklist both to be safe:

sudo tee /etc/modprobe.d/disable-cve-2026-31431.conf <<'EOF'
install algif_aead /bin/false
install authencesn /bin/false
EOF
sudo rmmod authencesn algif_aead 2>/dev/null || true

If rmmod says "module is in use", something on the box actively uses AF_ALG or IPsec (some VPNs, disk encryption, crypto userspace tooling). Don't force-unload it. Patch and reboot.

If the vulnerable code is compiled into your kernel, blacklisting won't help. Only a kernel update fixes it.

Tested on

AlmaLinux 8, AlmaLinux 9.7, CentOS 7 (TuxCare ELS), Ubuntu 22.04, Ubuntu 24.04.

Discussion

• Upstream advisory: oss-security mailing list — primary source.
• Forum thread: CVE-2026-31431 — danger (linuxcommunity.io)
• Issues: GitHub

Credits

Bug reports that shaped v1.0.1:

• u/throwaway234f32423df — flagged that Ubuntu's kmod blacklist update wasn't being detected, causing false VULNERABLE verdicts on patched Ubuntu hosts.
• u/aliendude5300 — pointed out that a loaded module that's been patched in place would still report VULNERABLE.

License

MIT — see LICENSE.