mahradbt/copyfail-mitigationAnsible playbooks to audit and mitigate CVE-2026-31431 ("Copy Fail"), a local privilege escalation vulnerability in the Linux kernel's `algif_aead` module affecting all major distributions since 2017.
Linux Kernel
algif_aeadPrivilege Escalation / Memory Corruption
Ansible-based audit and mitigation playbooks — ready to run in production
Copy Fail (CVE-2026-31431) is a vulnerability in the Linux kernel's
algif_aead module — the userspace-facing AEAD interface of the AF_ALG
crypto socket family.
A flaw in the kernel's copy_*user path inside the AEAD request handler
allows a local unprivileged user to corrupt kernel memory or escalate
privileges by crafting a malformed socket request.
| Field | Detail |
|---|
| CVE ID | CVE-2026-31431 |
| Nickname | Copy Fail |
| Component | Linux kernel — algif_aead (net/socket.c, crypto/algif_aead.c) |
| Attack vector | Local |
| Privileges required | Low (unprivileged user) |
| Impact | Kernel memory corruption / local privilege escalation |
| Patched | Upstream kernel patch in progress — check your distro vendor |
| Distribution | Affected versions | Status |
|---|---|---|
| Ubuntu 22.04 / 24.04 | kernels < patched release | Patch pending — see Ubuntu USN |
| Debian 12 (Bookworm) | kernels < patched release | Patch pending |
| RHEL / AlmaLinux / Rocky 8 & 9 | kernels < patched release | Patch pending |
| Amazon Linux 2 / 2023 | kernels < patched release | Patch pending |
| Generic upstream | algif_aead compiled in or auto-loaded | Vulnerable if module present |
A system is not at immediate risk if
algif_aeadis not loaded and no userspace tooling loads it on demand (see Audit step 1).
| Subsystem | Affected by this CVE? | Affected by mitigation? |
|---|---|---|
| dm-crypt / LUKS | No | No |
| kTLS | No | No |
| IPsec / StrongSwan | No | No |
| OpenSSL (default build) | No | No |
| GnuTLS / NSS | No | No |
| OpenSSH | No | No |
| OpenSSL afalg engine | Potentially yes | Yes — review before applying |
kcapi-enc / kcapi-dgst tools | Yes | Yes |
.
├── audit_algif_aead.yml # Step 1 — audit: detect exposure per host
├── mitigate_copyfail.yml # Step 2 — mitigation: unload + blacklist module
└── README.md # This document
community.general collection (ansible-galaxy collection install community.general)become: true (sudo) on target hostslsof installed on targets (usually present by default)inventory.ini is gitignored — it stays local and never reaches the repository.
inventory.ini.example is the committed template everyone starts from.
# Clone and prepare
git clone https://github.com/your-org/copy-fail-CVE-2026-31431.git
cd copy-fail-CVE-2026-31431
cp inventory.ini.example inventory.ini
# Edit inventory.ini with your real hosts, then run:
ansible-playbook -i inventory.ini audit_algif_aead.yml
The following paths are gitignored to prevent leaking infrastructure data:
| Gitignored path | Why |
|---|---|
inventory.ini | Real hostnames / IPs |
inventories/ | Any local inventory directory |
copyfail_reports/ | Audit output contains kernel versions, process lists |
.vault_pass | Ansible Vault password file |
*.retry | Ansible retry artefacts |
Run the audit playbook before touching anything. It collects per-host evidence and writes a report both locally and on each target.
ansible-playbook -i inventory.ini audit_algif_aead.yml
Reports are fetched to ./copyfail_reports/<hostname>_audit.txt.
| Check | Command | Verdict |
|---|---|---|
| Kernel version | uname -r | Informational |
| Module loaded? | lsmod | grep algif_aead | Loaded = exposure risk |
| Active AF_ALG sockets | lsof | grep AF_ALG | Users found = must review |
| OpenSSL afalg engine | openssl engine | grep afalg | Active = review impact |
| kcapi tools present | which kcapi-* | Present = potential users |
| Mitigation already applied | stat /etc/modprobe.d/disable-algif.conf | Present = already mitigated |
| Condition | Recommended action |
|---|---|
| Module NOT loaded | Low immediate risk — monitor for kernel patch |
| Module loaded, no AF_ALG socket users | Safe to apply mitigation |
| Module loaded and AF_ALG users active | Review processes before applying mitigation |
| Mitigation file already present | Mitigation was previously applied — verify |
Run the audit first. The mitigation playbook is safe to run idempotently but the audit gives you the evidence trail.
ansible-playbook -i inventory.ini mitigate_copyfail.yml
ansible-playbook -i inventory.ini mitigate_copyfail.yml \
-e '{"skip_hosts": ["db-prod-01", "hsm-node-02"]}'
/etc/modprobe.d/disable-algif.conf with install algif_aead /bin/falsealgif_aead module from the running kernel (no reboot required for initial protection)update-initramfs on Debian/Ubuntu, dracut --force on RHEL)/var/backup/copyfail_mitigation/mitigation.logNo reboot is required to remove the module from memory.
A reboot is still recommended to confirm the blacklist takes effect and to establish a clean post-mitigation state.
After the playbook completes, verify on any target host:
# Module must NOT appear
lsmod | grep algif_aead
# Blacklist file must exist and contain the install line
cat /etc/modprobe.d/disable-algif.conf
# Manual load must be rejected
sudo modprobe algif_aead # Expected: FATAL: Module algif_aead not found or refused
Once your vendor releases a patched kernel and you have applied it:
# On each host — remove the blacklist
sudo rm /etc/modprobe.d/disable-algif.conf
# Rebuild initramfs
sudo update-initramfs -u # Debian / Ubuntu
sudo dracut --force # RHEL / CentOS / Amazon Linux
# Reboot into the patched kernel
sudo reboot
Released under the MIT License.
Use at your own risk. Always validate in a staging environment before
applying to production systems.
Maintained by the community. PRs and issue reports welcome.