Copy Fail - CVE-2026-31431 Detector and Mitigator

Detect exposure to CVE-2026-31431 (Copy Fail) and optionally apply a host-level mitigation by disabling the algif_aead kernel module on vulnerable systems.

What this repo provides

• copyfail-check.sh — checks kernel patch status, runtime module exposure, and mitigation state.
• Optional automatic mitigation via --mitigate.
• Human-readable verdict output: NOT AFFECTED, PATCHED, NOT EXPLOITABLE, MITIGATED, MITIGATED (REBOOT PENDING), or AFFECTED.

Vulnerability summary

A 2017 in-place AEAD optimization (commit 72548b093ee3, kernel 4.14) allows an unprivileged local attacker to obtain a controlled page-cache write primitive against any readable file, enabling privilege escalation to root. In container environments the same primitive may facilitate container escape.

Kernels before 4.14 are NOT affected. This includes Ubuntu's 3.13 kernel (Trusty 14.04 GA) and 4.4 kernel (Xenial 16.04 GA, Trusty HWE) — those predates the vulnerable commit.

Commit references

Distros backport patches with their own commit identifiers. The script searches for the CVE ID in package changelogs, which is more reliable than the upstream hashes for backported kernels.

Affected Ubuntu releases

The Ubuntu Security Team distributes a kmod package update that writes install algif_aead /bin/false to /etc/modprobe.d/disable-algif_aead.conf. This script creates the same file with the same content and is fully compatible with that approach. Applying the official package update (sudo apt install --only-upgrade kmod) is the recommended path on Ubuntu; this script provides equivalent coverage for non-Ubuntu systems or pre-update triage.

Quick start

Local

chmod +x copyfail-check.sh
sudo ./copyfail-check.sh                # detection only
sudo ./copyfail-check.sh --mitigate     # detection + apply mitigation if affected

Remote (run directly from GitHub, no download)

Stream the script straight from main and execute it. The bash -s -- form forwards arguments after -- into the script itself, so --mitigate reaches the script and not bash.

# Detection only
curl -fsSL https://raw.githubusercontent.com/Webhosting4U/Copy-Fail_Detect_and_mitigate_CVE-2026-31431/main/copyfail-check.sh | sudo bash

# Detection + mitigation
curl -fsSL https://raw.githubusercontent.com/Webhosting4U/Copy-Fail_Detect_and_mitigate_CVE-2026-31431/main/copyfail-check.sh | sudo bash -s -- --mitigate

wget equivalents:

wget -qO- https://raw.githubusercontent.com/Webhosting4U/Copy-Fail_Detect_and_mitigate_CVE-2026-31431/main/copyfail-check.sh | sudo bash
wget -qO- https://raw.githubusercontent.com/Webhosting4U/Copy-Fail_Detect_and_mitigate_CVE-2026-31431/main/copyfail-check.sh | sudo bash -s -- --mitigate

Security note. Piping a remote script straight into a privileged shell trusts whatever the URL serves at the moment of execution. For one-off triage that is acceptable; for repeated or production use, pin to a specific commit and inspect the script first:

root@kitploit:~

curl -fsSL https://raw.githubusercontent.com/Webhosting4U/Copy-Fail_Detect_and_mitigate_CVE-2026-31431/<commit-sha>/copyfail-check.sh -o copyfail-check.sh
less copyfail-check.sh
sudo bash copyfail-check.sh --mitigate

What gets checked

1. Running as root
2. Kernel version pre-check — kernels before 4.14 exit immediately as NOT AFFECTED
3. Kernel patch evidence, in this order — any positive signal is sufficient:
   • Debian/Ubuntu kernel-package changelog (searches for all three fix commit hashes and the CVE ID)
   • RHEL/Fedora kernel-package changelog (same patterns)
   • Loaded kernel livepatches under /sys/kernel/livepatch/, plus kpatch list and canonical-livepatch status
   • Distro CVE tooling: ubuntu-security-status --cves, dnf updateinfo list cves, zypper patch-check
4. algif_aead module availability (modinfo) and load state (lsmod)
5. Existing modprobe-based block rules under /etc/modprobe.d/ — accepts equivalent neutralizers (install … /bin/false|/bin/true|/sbin/nologin) and ; identifies whether the block came from the Ubuntu kmod package

Verdict meanings

What mitigation does

When --mitigate is used on an affected system, the script:

• Creates /etc/modprobe.d/disable-algif_aead.conf containing install algif_aead /bin/false
• Attempts to unload algif_aead if currently loaded
• Leaves a persistent boot-time block in place

The filename /etc/modprobe.d/disable-algif_aead.conf matches the file written by the official Ubuntu kmod package update, so both approaches are interchangeable and compatible.

Important notes

• Mitigation is a temporary risk reduction, not a replacement for kernel patching.
• Disabling algif_aead is safe for common crypto paths: dm-crypt, LUKS, kTLS, IPsec, default OpenSSL/GnuTLS usage, SSH, and kernel keyring crypto are unaffected.
• Applications that explicitly load the OpenSSL afalg engine will lose hardware acceleration; they should fall back to software crypto, but a reboot may be required to trigger the fallback.
• Container workloads: the vulnerability may enable container escape even without a published PoC. Applying the mitigation or kernel patch is recommended regardless of workload type.

Disclosure timeline

Requirements

• Linux host
• Root privileges (sudo or root shell)
• Core tools (always required): uname, modinfo, lsmod, awk, grep
• Optional tools (used when present, in order of authority):
  • dpkg — Debian/Ubuntu changelog scan and kmod version check
  • lsb_release — Ubuntu release detection for kmod hint
  • rpm — RHEL/Fedora changelog scan
  • kpatch / canonical-livepatch and /sys/kernel/livepatch/ — live-patch detection
  • ubuntu-security-status, dnf updateinfo, — distro CVE tooling

Repository structure

.
├── copyfail-check.sh
└── README.md

References

• copy.fail — official vulnerability page
• Copy Fail across Linux distributions — distribution coverage analysis
• oss-security disclosure — full technical disclosure
• Ubuntu Security Advisory — Ubuntu-specific guidance and fixed package versions
• CVE Record — official CVE entry