copyfail2_electric_boogaloo_fix

A temporary mitigation against copy_fail variant (copyfail2_electric_boogaloo) - Unprivileged Linux LPE via xfrm ESP-in-UDP MSG_SPLICE_PAGES no-COW fast path. Page-cache write into any readable file. Overwrites a nologin line in /etc/passwd with sick::0:0:…:/:/bin/bash and sus into it. Same class as Copy Fail (CVE-2026-31431), different subsystem.

Important:

Be careful when blacklisting modules in /etc/modprobe.d this can break your system. I have created a --low-risk-fix to address this issue as the original mitigation blocks way too many modules.

Usage:

1. Recommended to run as root when using apply argument
2. sudo bash copyfail2_electric_boogaloo_fix.sh <status, apply, rollback>
3. File has a verbose help menu, --help

Example:

sudo bash copyfail2_electric_boogaloo_fix.sh --help
[sudo] password for _0xhex:
Usage:
  copyfail2_electric_boogaloo_mitigation.sh apply
    copyfail2_electric_boogaloo_mitigation.sh --low-risk-fix
  copyfail2_electric_boogaloo_mitigation.sh status
  copyfail2_electric_boogaloo_mitigation.sh rollback

Modes:
  apply    Write persistent hardening files + apply live mitigation.
    --low-risk-fix  Apply only sysctl hardening and skip module block/unload.
  status   Show whether mitigations are active and whether modules are blocked.
  rollback Remove mitigation files and restore saved sysctl values.

sudo bash copyfail2_electric_boogaloo_fix.sh --low-risk-fix