sunl0w/patch-cve-2026-31431-ubuntu_debianPermanent mitigation scripts for CVE-2026-31431 (Copy Fail) on Ubuntu 24.04, blacklisting the vulnerable algif_aead kernel module and updating initramfs to persist across reboots.
This repository contains scripts designed to neutralize the critical vulnerability CVE-2026-31431, nicknamed "Copy Fail", on Ubuntu systems.
[!IMPORTANT] Compatibility: These scripts are tailored for and tested on Ubuntu Server 24.04 LTS. While the logic is similar for other distributions, they have not been tested on Debian or other Linux flavors.
Before applying the patch, download the official detection script (developed by rootsecdev) to validate your system's current status :
# Download the detection script
wget https://raw.githubusercontent.com/rootsecdev/cve_2026_31431/main/test_cve_2026_31431.py
# Ensure you have python3 installed
python3 --version
The CVE-2026-31431 vulnerability ($CVSS\ 7.8$) affects the Linux kernel's cryptographic subsystem (algif_aead module).
A local user can corrupt the system's Page Cache by exploiting a flaw in the "in-place" optimization of the splice() function. This allows an attacker to force the kernel to write arbitrary data (sequence numbers) into memory pages of files that should be read-only (such as SUID binaries or sensitive system files).
modprobe -r is not enoughThe Linux kernel uses a mechanism called auto-loading. If a process or script (like the detector) requests a socket of type AF_ALG, the kernel automatically reloads the module even if it was manually removed. The method used in this patch ("Hard Block") physically prevents the module binary from being loaded by the kernel.
Run the tester to confirm if your current kernel is exposed :
python3 test_cve_2026_31431.py
If the script displays [!] VULNERABLE, proceed to the next step.
The patch-CVE-2026-31431.sh script neutralizes the attack vector permanently. It creates a configuration file in /etc/modprobe.d/ and updates the initramfs to ensure the block persists after a reboot.
chmod +x patch-CVE-2026-31431.sh
sudo ./patch-CVE-2026-31431.sh
Run the detection script again. You should now see a message indicating that prerequisites are not met :
[+] Precondition not met ('authencesn(...) cannot be instantiated).
This confirms the module is successfully neutralized.
Once Ubuntu releases an official fix via a kernel update (check apt upgrade notes for CVE-2026-31431), you should restore the native cryptographic capabilities :
chmod +x unpatch-CVE-2026-31431.sh
sudo ./unpatch-CVE-2026-31431.sh
The protection relies on the following directive within /etc/modprobe.d/cve-2026-31431-mitigation.conf :
blacklist algif_aead
install algif_aead /bin/true
The install command redirects the kernel's attempt to load the module to /bin/true, which returns a "success" exit code without executing any vulnerable code.
