sebinxavi/cve-checker-2026Multi-OS vulnerability checker for CVE-2026-31431 (Linux kernel) and CVE-2026-41940 (cPanel)
| Family | Distributions |
|---|
| Debian | Ubuntu, Debian, Linux Mint, Pop!_OS |
| RHEL | RHEL, CentOS, AlmaLinux, Rocky Linux, Oracle Linux, CloudLinux, Fedora, Amazon Linux |
| SUSE | SLES, openSUSE |
Run directly from GitHub:
curl -fsSL https://raw.githubusercontent.com/sebinxavi/cve-checker-2026/main/cve_check_2026.sh | sudo bash
Or download then execute (recommended for review first):
curl -fsSL -o cve_check_2026.sh https://raw.githubusercontent.com/sebinxavi/cve-checker-2026/main/cve_check_2026.sh
chmod +x cve_check_2026.sh
sudo ./cve_check_2026.sh
algif_aead / af_alg module load stateapt, dnf, yum, zyppercpsrvd service status| File | Purpose |
|---|---|
/var/log/cve_check_2026_<timestamp>.log | Full debug log |
/var/log/cve_check_2026_<timestamp>.report.txt | Executive summary |
Falls back to /tmp/ if /var/log is not writable.
| Code | Meaning |
|---|---|
0 | All clear or not applicable |
1 | Script error (not root, missing tools) |
2 | At least one CVE confirmed vulnerable |
Useful for automation and monitoring integration.
| Status | Meaning |
|---|---|
SAFE | Confirmed patched |
LIKELY_SAFE | Probably safe; not confirmed in changelog |
MITIGATED | Workaround applied (e.g., module blacklist) |
VULNERABLE | Patch available, not applied |
VULNERABLE_EOL | End-of-life version, no patch path |
NOT_APPLICABLE | Software not installed |
UNKNOWN | Could not determine automatically |
For cPanel servers, a companion script is available to audit active session files for signs of exploitation from CVE-2026-41940.
Scans all files in /var/cpanel/sessions/raw/ and categorises each session into one of three groups:
| Result | Meaning |
|---|---|
LEGITIMATE | Real login via handle_form_login, passwd, or api_token |
SUSPICIOUS | Attack payload (badpass) detected — no successful access |
COMPROMISED | Attack payload with HTTP 200 response in access log — root was accessed |
curl -fsSL https://raw.githubusercontent.com/sebinxavi/cve-checker-2026/main/cpanel_session_checker.sh | sudo bash
Or download first:
curl -fsSL -o cpanel_session_checker.sh https://raw.githubusercontent.com/sebinxavi/cve-checker-2026/main/cpanel_session_checker.sh
chmod +x cpanel_session_checker.sh
sudo ./cpanel_session_checker.sh
If COMPROMISED sessions are found:
/tmp, cron, and ~/.ssh/authorized_keys for malwareThe compromised server cannot be trusted — migrate all cPanel accounts to a freshly provisioned clean server:
# On the compromised server — list all accounts
/usr/local/cpanel/bin/whmapi1 listaccts | grep 'user:'
# Package each account for migration
/scripts/pkgacct <username> /backup
# On the clean server — restore each account
/scripts/restorepkg /backup/cpmove-<username>.tar.gz
Alternatively use WHM >> Transfer Tool >> Copy Multiple Accounts from Another Server for bulk migration with full fidelity.
After migration: update DNS to point domains to the new server IP, verify all sites load, then decommission or reimage the compromised server.
If only SUSPICIOUS sessions are found (all blocked):
/scripts/upcp --forcerm -f /var/cpanel/sessions/raw/*After an attack (even if blocked), it is recommended to rotate all cPanel account passwords as a precaution. A dedicated script is available to mass-reset all cPanel account passwords and save them to a secure CSV file.
whmapi1/root/cpanel_new_passwords_<timestamp>.csv (mode 600)/root/cpanel_passwd_reset_<timestamp>.logcurl -fsSL https://raw.githubusercontent.com/sebinxavi/cve-checker-2026/main/cpanel_mass_passwd_reset.sh | sudo bash
After securely delivering new passwords to account holders, delete the CSV:
shred -u /root/cpanel_new_passwords_*.csv
Update cPanel to the patched build for your branch:
| Branch | Minimum Build |
|---|---|
| 110.x | 11.110.0.97 |
| 118.x | 11.118.0.63 |
| 126.x | 11.126.0.54 |
| 132.x | 11.132.0.29 |
| 134.x | 11.134.0.20 |
| 136.x | 11.136.0.5 |
/scripts/upcp --force
/scripts/restartsrv_cpsrvd
Debian / Ubuntu:
apt update && apt upgrade -y && reboot
RHEL / AlmaLinux / CloudLinux:
dnf update kernel -y && reboot
# or
yum update kernel -y && reboot
With KernelCare (no reboot required):
kcarectl --update
Warning: Do not run
apt upgrade -yon a cPanel server — it can upgrade packages managed by cPanel (Apache, PHP, MySQL) and break services.
Upgrade the kernel package only:
apt-get install --only-upgrade linux-image-generic linux-headers-generic linux-generic
reboot
Verify after reboot:
uname -r
AWS EC2 instances use a different kernel package (linux-aws) — the generic package names will not update the running kernel:
apt update && apt install --only-upgrade -y \
linux-aws \
linux-image-aws \
linux-headers-aws && \
echo "" && \
echo "Currently running : $(uname -r)" && \
echo "Will boot next : $(ls /boot/vmlinuz-* | sort -V | tail -1 | sed 's|/boot/vmlinuz-||')"
Confirm the next boot kernel shown, then reboot:
reboot
Blacklist the vulnerable module to prevent it from loading:
echo "blacklist algif_aead" >> /etc/modprobe.d/disable-algif-aead.conf
echo "blacklist af_alg" >> /etc/modprobe.d/disable-algif-aead.conf
update-initramfs -u # Debian/Ubuntu
# or
dracut --force # RHEL family
Re-run the checker to confirm status changes to MITIGATED. Apply the kernel patch at the next maintenance window.
sudo tee /etc/cron.weekly/cve-check-2026 > /dev/null <<'EOF'
#!/bin/bash
curl -fsSL https://raw.githubusercontent.com/sebinxavi/cve-checker-2026/main/cve_check_2026.sh | bash
if [[ $? -eq 2 ]]; then
REPORT=$(ls -t /var/log/cve_check_2026_*.report.txt | head -1)
mail -s "[CVE ALERT] $(hostname) vulnerable" [email protected] < "${REPORT}"
fi
EOF
sudo chmod +x /etc/cron.weekly/cve-check-2026
for host in server1 server2 server3; do
ssh root@${host} "curl -fsSL https://raw.githubusercontent.com/sebinxavi/cve-checker-2026/main/cve_check_2026.sh | bash" \
> "report_${host}_$(date +%F).txt" &
done
wait
This script is read-only — it only inspects the system and writes log files. It does not:
Always review the script before piping curl to bash. View the source at:
https://github.com/sebinxavi/cve-checker-2026/blob/main/cve_check_2026.sh
MIT — see LICENSE
Sebin Xavi — sebintech.com