mlazzarotto/copy-fail-cve-2026-31431-mitigation-ansible-playbookAn Ansible Playbook to mitigate the vulnerability CVE-2026-31431 on RHEL-based and Debian-based OSes.
An Ansible playbook to apply and rollback the CVE-2026-31431 (AF_ALG) kernel module mitigation on both Debian/Ubuntu and RHEL/Rocky/AlmaLinux systems.
This playbook mitigates CVE-2026-31431 by disabling the vulnerable algif_aead kernel module:
grubby to add a kernel initcall blacklist argument⚠️ Important: The playbook does NOT automatically reboot your servers. It displays a reminder message when a reboot is required, allowing operators to schedule reboots during maintenance windows.
Sample configuration files are provided in the examples/ directory:
# Copy sample inventory
cp examples/inventory/hosts.ini inventory/hosts.ini
# Copy sample ansible configuration (optional)
cp examples/ansible.cfg ansible.cfg
See examples/README.md for detailed customization instructions.
Edit inventory/hosts.ini with your server details:
[servers]
server1.example.com
server2.example.com ansible_host=192.168.1.50
[servers:vars]
ansible_user=admin
ansible_become=true
ansible all -m ping
ansible-playbook mitigation-playbook.yaml
To apply the mitigation to all hosts in your inventory:
ansible-playbook mitigation-playbook.yaml
To apply to specific hosts or groups:
ansible-playbook mitigation-playbook.yaml --limit webservers
To rollback (remove) the mitigation:
ansible-playbook mitigation-playbook.yaml -e "rollback=true"
Or use the rollback tag:
ansible-playbook mitigation-playbook.yaml --tags rollback -e "rollback=true"
To remove deprecated systemd drop-in files (if migrating from an older version of this mitigation):
ansible-playbook mitigation-playbook.yaml -e "run_systemd_cleanup=true"
TASK [CVE-2026-31431 Summary (Debian)] ****************************************
ok: [server1] => {
"msg": [
"===== CVE-2026-31431 SUMMARY — server1 =====",
"Action: apply",
"Module loaded (pre): False",
"Module loaded (post): False",
"Reboot required: False"
]
}
TASK [Remind operator to reboot (RHEL)] ****************************************
ok: [server2] => {
"msg": "REMINDER: Kernel args changed. Reboot required to activate mitigation."
}
TASK [CVE-2026-31431 Summary (Red Hat)] ****************************************
ok: [server2] => {
"msg": [
"===== CVE-2026-31431 SUMMARY — server2 =====",
"Action: apply",
"Kernel arg active (pre): False",
"Kernel arg active (post): False",
"Reboot required: True"
]
}
TASK [Remind to reboot if required (Red Hat)] **********************************
ok: [server2] => {
"msg": "REMINDER: A reboot is required to activate/deactivate the mitigation on this Red Hat-based host."
}
| OS Family | Reboot Required When | Behavior |
|---|---|---|
| Debian/Ubuntu | Module was "in use" and couldn't be unloaded | Reminder only |
| RHEL/Rocky/Alma | Grubby made changes to kernel args | Reminder only |
The playbook is designed to never reboot automatically to give operators full control over maintenance windows.
| Variable | Default | Description |
|---|---|---|
rollback | false | Set to true to rollback the mitigation |
run_systemd_cleanup | false | Set to true to remove deprecated systemd drop-ins |
target_hosts | all | Limit execution to specific hosts or groups |
mitigation_serial | 25% | Batch size for rolling execution |
mitigation - Run only the apply mitigation tasksrollback - Run only the rollback taskssystemd-cleanup - Run only the systemd cleanup tasksExample:
# Run only mitigation tasks
ansible-playbook -i inventory/hosts.ini mitigation-playbook.yaml --tags mitigation
# Run only rollback tasks
ansible-playbook -i inventory/hosts.ini mitigation-playbook.yaml --tags rollback -e "rollback=true"
After running the playbook (and rebooting if prompted), verify the mitigation is active:
# Check if module is blacklisted
cat /etc/modprobe.d/disable-algif.conf
# Check if module is loaded (should return nothing)
lsmod | grep algif_aead
# Check if kernel arg is present
grep initcall_blacklist /proc/cmdline
# Should output something like:
# ... initcall_blacklist=algif_aead_init ...
MIT License - See LICENSE file for details
Contributions are welcome! Please submit issues and pull requests.
This playbook was created taking inspiration from the following sources:
This playbook is provided as-is. Always test thoroughly in your environment before applying to production systems. The authors are not responsible for any system damage or downtime caused by the use of this playbook.