copyfail-guard

Automated detection and mitigation tool for the vulnerability CVE-2026-31431 ("Copy Fail"), a local privilege escalation (LPE) in the algif_aead module (AF_ALG interface) of the Linux kernel.

⚠️ Scope: this project is purely defensive. It does not contain, generate, or reference exploit code. The goal is to enable security teams and system administrators to (1) identify exposed hosts and (2) apply the recommended mitigation (blocking the algif_aead module) until the patched kernel is installed.

What the tool does

1. Detection (--check)

   • Reads the running kernel version (uname -r)
   • Checks whether the algif_aead module is loaded or available for loading
   • Queries the installed kernel package changelog (apt/dpkg, rpm, zypper) for a reference to the patch/CVE
   • Identifies the distribution via /etc/os-release
   • Returns a verdict: VULNERABLE, MITIGATED (module blocked), FIXED (kernel already contains the patch), or INDETERMINATE

2. Mitigation (--mitigate, requires root)

   • Creates /etc/modprobe.d/disable-algif-aead-cve-2026-31431.conf with install algif_aead /bin/false and blacklist algif_aead
   • Removes the module from memory if it is already loaded (rmmod)
   • Re-runs the detection check to confirm that the mitigation took effect
   • Idempotent operation: can be run as many times as needed with no side effects

3. Report (--report json|text)

   • Human-readable output or structured JSON, ready to feed SIEM, asset audit pipelines, or dashboards

Quick usage

# Apenas diagnosticar (não requer root)
sudo ./bin/copyfail-guard --check

# Diagnosticar e aplicar mitigação temporária
sudo ./bin/copyfail-guard --mitigate

# Saída em JSON para integração com outras ferramentas
sudo ./bin/copyfail-guard --check --report json

Requirements: Python 3.8+, Bash, root access only for --mitigate (the check works without elevated privileges, with limited information).

Important notice

• The mitigation (blocking algif_aead) is temporary. It reduces the attack surface but does not replace the kernel update. As soon as the patched kernel package (containing commit a664bf3d603d or an equivalent backport) is available for your distribution, it must be applied and the system rebooted.
• Environments that depend on algif_aead (direct use of AF_ALG for AEAD via userspace) may have functionality impacted by the mitigation. dm-crypt/LUKS, kTLS, IPsec, SSH and standard OpenSSL/GnuTLS builds normally do not depend on AF_ALG and are not affected.

Repository structure

copyfail-guard/
├── bin/
│   └── copyfail-guard        # entrypoint (bash) -> chama o módulo Python
├── copyfail_guard/
│   ├── __init__.py
│   ├── detect.py              # lógica de detecção
│   ├── mitigate.py            # lógica de mitigação
│   └── report.py              # formatação de saída (texto/JSON)
├── tests/
│   └── test_detect.py
├── LICENSE
└── README.md

References

• copy.fail
• NVD — CVE-2026-31431
• Red Hat RHSB-2026-002
• Ubuntu Security Notices (discourse.ubuntu.com)
• Sysdig / Unit 42 / Tenable / Microsoft Security Blog (technical analyses)

License

MIT — see LICENSE.