copy-fail-mitigate

Minimal no-reboot mitigation helper for Copy Fail / CVE-2026-31431.

This script disables the vulnerable algif_aead module path and attempts to unload the module immediately. It also performs a best-effort page-cache eviction for /usr/bin/su.

This is a mitigation, not a kernel fix. Install your vendor's patched kernel as soon as it is available.

What it does

The script runs the mitigation recommended by the public Copy Fail advisory:

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true

This prevents algif_aead from being loaded again via modprobe and unloads it from the running kernel if possible.

It then runs a small Python snippet that calls posix_fadvise() with POSIX_FADV_DONTNEED for the first page of /usr/bin/su:

os.posix_fadvise(fd, 0, page, os.POSIX_FADV_DONTNEED)

This is a best-effort attempt to evict the relevant page from page cache. It is not a substitute for patching and does not guarantee cleanup of every possible targeted setuid binary.

Why /usr/bin/su?

The public Copy Fail proof-of-concept targets /usr/bin/su by default. This script therefore attempts to drop the first page of /usr/bin/su from page cache after disabling the vulnerable module path.

If your environment has tested or suspected exploitation against another setuid binary, review and adapt the script accordingly.

Usage

Review the script first.

sudo ./mitigate-copy-fail.sh

Verify

Check that the module is not loaded:

lsmod | grep '^algif_aead' || echo "algif_aead is not loaded"

Check that the modprobe rule exists:

cat /etc/modprobe.d/disable-algif.conf

Expected output:

install algif_aead /bin/false

Try to load the module manually:

sudo modprobe algif_aead

It should fail or refuse to load.

Revert

Only revert this after installing a fixed kernel or after accepting the risk.

sudo rm -f /etc/modprobe.d/disable-algif.conf
sudo modprobe algif_aead

Limitations

This script does not:

• patch the kernel;
• verify whether the running kernel is vulnerable;
• guarantee eviction of all relevant page-cache state;
• inspect all setuid binaries;
• replace vendor security updates;
• provide container or sandbox hardening.

For untrusted workloads such as containers, sandboxes, CI runners, and multi-user hosts, consider additional hardening such as blocking AF_ALG socket creation with seccomp.

References

• https://copy.fail/#mitigation