
eBPF-based workaround for CVE-2026-31431 (Copy.Fail) that filters or kills AF_ALG socket creation to prevent local privilege escalation and container escape.
This CVE allows authorized user change cache copy of any readable file, which leads to Local Privilege Escalation (aka local root exploit), sandbox/container escape and other issues. It works by creating AF_ALG socket that is provided by algif* kernel modules.
Current well-known workaround recommends disabling algif_aead module, that is not possible if the module is built-in, like in Fedora Linux, Oracle Linux and others RHEL-based. Also, some upstreams are still missing the patch. It means your systems will be vulnerable until you patch your kernel.
This package provides you two eBPF programs:
I recommend use first one IF you have eBPF LSM module enabled in your kernel. You can check it by calling
cat /sys/kernel/security/lsm
and checking if bpf is there.
If you don't have eBPF LSM module, use second program, it's more rude but protects as well.
build.sh buildapply.sh load to loadapply.sh unload to unloadapply.sh status to check status