copy-fail-mitigation-with-bpftrace

CVE-2026-31431, AKA Copy Fail, can be mitigated in one-line with bpftrace, no kpatch building, no cargo building

English Version | 中文版本

Idea

To exploit Copy Fail, you need to bind socket AF_ALG and use algorithm authencesn, which most applications don't use a lot. And that's where the mitigation can involve.

files

├── kfunc.sh

├── kprobe.sh

├── tests

│   └── bind_af_alg.py

└── tracepoint.sh

Why these files

the Author of tracepoint.sh is @天擎智能云, who published his writing at Wechat Public Accounts

I tested his script, and it worked out fine.

However, inspired by https://github.com/Jannik2099/copyfail-ebpf-mitigation I find that who bind socket AF_ALG but did not use algorithm authencesn, it may kill unconditionally.

The code explained for me.

Therefore, with the help of Deepseek, and after a day of manual experimentation, I verified kprobe.sh and kfunc.sh, who can log and deny all attempts to use bind() with salg_name=authencesn.

Test results

Requirements

!!unverified!!