copy-fail-check

CVE-2026-31431 Helper based on https://copy.fail/

Copy Fail Quick Check

Interactive bash helper to review basic exposure related to CVE-2026-31431 (Copy Fail) and apply a temporary mitigation based on algif_aead.

Target compatibility

Mainly intended for:

• Debian / Ubuntu
• AlmaLinux / Rocky / RHEL or RedHat-based systems.

What does it do?

• Shows operating system, family, and kernel
• Checks if algif_aead is available
• Checks if algif_aead is loaded
• Checks if the mitigation file already exists
• Suggests patching flow based on family (apt or dnf)
• Allows applying temporary mitigation
• Allows reverting temporary mitigation

What does it NOT do?

• Does not 100% confirm if the system is already patched based on version alone
• Does not replace kernel patching
• Does not modify firewall, SSH, or other services unrelated to this mitigation

Files

• Main script:
  • copyfail-tool.sh
• README:
  • readme.rd

Usage

Grant permissions and run:

chmod +x copyfail-tool.sh
./copyfail-tool.sh

To apply or revert mitigation, run it with sudo:

sudo ./copyfail-tool.sh

Menu options

1. Check status
2. Apply temporary mitigation
3. Remove temporary mitigation
4. About
5. Exit

Temporary mitigation it applies

Creates this file:

/etc/modprobe.d/disable-algif.conf

With this line:

install algif_aead /bin/false

And then attempts:

rmmod algif_aead

Screenshots.

Before applying the mitigation:

After applying the mitigation:

Important recommendation

This tool is for quick review and temporary containment. The main recommendation remains:

• patch the kernel as soon as possible
• for untrusted workloads, also consider blocking AF_ALG via seccomp

Note

Many distributions apply security backports, so the kernel version alone does not always confirm whether you are already protected.