CVE-2026-31431 (Copy Fail) Detection and Mitigation Tool

This project provides a set of Bash scripts for detecting and mitigating CVE-2026-31431 (also known as "Copy Fail"), a Linux kernel local privilege escalation vulnerability.

Vulnerability Overview

• CVE ID: CVE-2026-31431
• Vulnerability Type: Local Privilege Escalation
• Affected Component: Linux Kernel - AF_ALG socket / AEAD crypto interface
• Fix Commit: a664bf3d603d and subsequent patches
• Public Name: Copy Fail

This vulnerability exists in the AF_ALG socket implementation of the Linux kernel. Attackers may achieve local privilege escalation by crafting specific authencesn bind operations.

Project Files

Quick Start

1. Check Whether the System Is Affected

bash check_cve_2026_31431.sh

The script checks the following items one by one:

• Kernel configuration CONFIG_CRYPTO_USER_API_AEAD status
• algif_aead / af_alg module load status
• AF_ALG socket creation capability
• Whether existing mitigation configurations are present
• authencesn bind verification (to determine whether mitigation is already applied)
• Whether the distribution is on the known affected list

Finally, it outputs an overall risk level: UNKNOWN / LOW / MEDIUM / HIGH.

2. Execute Mitigation Measures

Note: The mitigation script requires root privileges to run.

sudo bash cve-2026-31431-mitigate.sh

Mitigation operations include:

• Writing /etc/modprobe.d/disable-algif-aead.conf to block loading of the algif_aead module
• Attempting to unload (rmmod) the algif_aead module if it is already loaded
• Running depmod -a to update module dependencies
• Automatically verifying AF_ALG socket creation and bind capability before and after mitigation

Optional Parameters

sudo bash cve-2026-31431-mitigate.sh --verify-only          # Verify only, do not write configuration
sudo bash cve-2026-31431-mitigate.sh --write-seccomp        # Additionally generate Docker seccomp configuration
sudo bash cve-2026-31431-mitigate.sh --seccomp-path /path   # Specify seccomp output path

Mitigation Effectiveness Verification

The gold standard for determining whether mitigation is effective: authencesn bind fails.

The "Check Item 5: Mitigation Verification (bind authencesn)" in the detection script attempts to execute:

import socket
s = socket.socket(38, 5, 0)  # AF_ALG
s.bind(("aead", "authencesn(hmac(sha256),cbc(aes))"))

• If an error is returned (bind fails) → Mitigated or capability has been blocked
• If success is returned → Not mitigated, further action is required

Known Limitations

1. Ineffective for statically compiled scenarios: If the kernel is configured with CONFIG_CRYPTO_USER_API_AEAD=y (statically compiled into the kernel), module disabling methods usually do not work; only a kernel upgrade will help.
2. Module in use: If algif_aead is currently in use, rmmod may fail to unload it. It is recommended to verify after a reboot during a maintenance window.
3. Container environments: It is recommended to layer seccomp configurations to block socket(AF_ALG) calls.

Follow-up Recommendations

1. Root fix: Upgrade to an official kernel version that includes fix commit a664bf3d603d and subsequent patches.
2. Track advisories:
   • Ubuntu: https://ubuntu.com/security/CVE-2026-31431
   • RHEL: https://access.redhat.com/security/cve/CVE-2026-31431
   • SUSE: Refer to the distribution security advisory
3. Re-test to confirm: After upgrading or mitigating, re-run the detection script to confirm that the bind verification fails.

Compatibility

The scripts have been tested in the following environments:

• Bash 4.x / 5.x
• Dependencies: standard GNU tools (grep, sed, lsmod, modprobe, rmmod, depmod)
• Optional dependency: python3 or python (for AF_ALG socket verification)

License

MIT License

Disclaimer

The scripts provided in this project are intended for security detection and temporary mitigation only and cannot replace official kernel patch upgrades. Please fully understand the operations they perform (such as disabling kernel modules) before using these scripts, and verify them in a test environment first. The author is not responsible for any direct or indirect losses caused by the use of this tool.