joltcan/ansible-role-cve-2026-31431Ansible role that applies and verifies the modprobe.d mitigation for CVE-2026-31431 by disabling the algif_aead kernel module, with safety checks for Debian-family systems.
Ansible role to apply (and later remove) the modprobe.d mitigation for
CVE-2026-31431 ("Copy Fail") in the Linux kernel's AF_ALG / algif_aead
subsystem.
Tested on Debian. Pull requests for other distributions, edge cases, or improvements are very welcome.
The role drops a config snippet into /etc/modprobe.d/ that prevents the
algif_aead kernel module from being loaded:
install algif_aead /bin/false
It then verifies the mitigation is actually effective by:
/boot/config-$(uname -r) and refusing to run if AEAD is built
into the kernel (CONFIG_CRYPTO_USER_API_AEAD=y) — modprobe.d cannot block
built-in code.algif_aead is not currently in lsmod.AF_ALG socket and tries to
bind() to aead/gcm(aes). After the mitigation, the bind must fail with
FileNotFoundError.No reboot is required.
To revert (e.g. once a patched kernel is in place), set
cve_2026_31431_state=absent.
The mitigation circulating on oss-security — dropping
install algif_aead /bin/false into /etc/modprobe.d/ and rmmod'ing the
module — does not work on CloudLinux, AlmaLinux, RHEL, or any other
RHEL-family distribution, and does not work on custom kernels built with
AEAD compiled in.
On those systems algif_aead is built into the kernel
(CONFIG_CRYPTO_USER_API_AEAD=y), so:
modprobe.d rules cannot block loading (there is nothing to load — the
code is already in the kernel image).rmmod algif_aead cannot remove built-in code.The commands appear to succeed but leave the system unchanged, giving a false sense of protection. You can confirm whether your kernel is affected:
zgrep '^CONFIG_CRYPTO_USER_API_AEAD=' /boot/config-$(uname -r)
=m → module, this role can mitigate.=y → built-in, you need a kernel update + reboot or a livepatch
subscription. This role will detect this and refuse to run.| Name | Default | Notes |
|---|---|---|
cve_2026_31431_state | present | Set to absent to remove mitigation |
cve_2026_31431_conf | /etc/modprobe.d/disable-algif_aead.conf | Path to the blacklist file |
ansible-galaxy install joltcan.cve_2026_31431
ansible-playbook -i <your-inventory> ~/.ansible/roles/joltcan.cve_2026_31431/playbook.yml
Cleanup once the patched kernel is running:
ansible-playbook -i <your-inventory> ~/.ansible/roles/joltcan.cve_2026_31431/playbook.yml -e cve_2026_31431_state=absent
- hosts: all
become: true
roles:
- role: joltcan.cve_2026_31431
Issues and pull requests are welcome — particularly:
algif_aead is loadable
(Arch, Gentoo, Alpine, etc.).algif_aead when no AF_ALG
users are active.MIT — see LICENSE.