copy-fail-check — Interactive bash helper to check exposure to CVE-2026-31431 (Copy Fail) and apply temporary mitigation by disabling algif_aead module on Debian/Ubuntu and RHEL-based systems. | Kitploit
Tools / GitHub / jbnetwork-git / copy-fail-check
jbnetwork-git/copy-fail-check copy-fail-check Interactive bash helper to check exposure to CVE-2026-31431 (Copy Fail) and apply temporary mitigation by disabling algif_aead module on Debian/Ubuntu and RHEL-based systems.
31 7 3 months agoDiscover the most used tools by our community.
Last 7 Days Last 30 Days
copy-fail-check
CVE-2026-31431 Helper based on https://copy.fail/
Copy Fail Quick Check
Interactive bash helper to review basic exposure related to CVE-2026-31431 (Copy Fail) and apply a temporary mitigation based on algif_aead.
Target compatibility
Mainly intended for:
Debian / Ubuntu
AlmaLinux / Rocky / RHEL or RedHat-based systems.
What does it do?
Shows operating system, family, and kernel
Checks if algif_aead is available
Checks if algif_aead is loaded
Checks if the mitigation file already exists
Suggests patching flow based on family ( or )
apt
dnf
Allows applying temporary mitigation
Allows reverting temporary mitigation
What does it NOT do?
Does not 100% confirm if the system is already patched based on version alone
Does not replace kernel patching
Does not modify firewall, SSH, or other services unrelated to this mitigation
Files
Usage Grant permissions and run:
chmod +x copyfail-tool.sh
./copyfail-tool.sh
To apply or revert mitigation, run it with sudo:
Check status
Apply temporary mitigation
Remove temporary mitigation
About
Exit
Temporary mitigation it applies /etc/modprobe.d/disable-algif.conf
install algif_aead /bin/false
Screenshots. Before applying the mitigation:
After applying the mitigation:
Important recommendation This tool is for quick review and temporary containment.
The main recommendation remains:
patch the kernel as soon as possible
for untrusted workloads, also consider blocking AF_ALG via seccomp
Note Many distributions apply security backports, so the kernel version alone does not always confirm whether you are already protected.