yakovyakov/cve-2026-31431-mitigationDetection and mitigation tooling for CVE-2026-31431 (Copy Fail) on Linux kernels. Includes Phalanx-CCS and Silent4Labs scripts plus an Ansible playbook to apply temporary mitigation (block algif_aead module or boot parameter) across servers.
This package provides an automated solution to detect and mitigate the CVE-2026-31431 vulnerability (aka Copy Fail) on Linux systems running affected kernels (versions 4.14 through 6.12.84, 6.13 through 6.18.21, etc.).
The tooling consists of:
mitigate_copyfail.sh) that:
CONFIG_CRYPTO_USER_API_AEAD=m|y).=m): creates /etc/modprobe.d/disable-algif-aead.conf with install algif_aead /bin/false and unloads the module (rmmod).=y): adds the kernel boot parameter initcall_blacklist=algif_aead_init (requires reboot).mitigation.yml) that:
Important note: The mitigation is temporary. The permanent fix is to upgrade the kernel to a version that includes the patch
a664bf3d603d(≥6.18.22, ≥6.19.12 or ≥7.0).
become: yes)sudo privileges (to apply the mitigation)The detection scripts (Phalanx-CCS and Silent4Labs) are safe and do not exploit the vulnerability; they only verify the attack surface.
cve-2026-31431-mitigation/
├── README.md
├── scripts/
│ ├── mitigate_copyfail.sh # Unified script (detection + mitigation)
│ ├── check_copyfail.py # Phalanx-CCS (reachability checker)
│ └── check-copyfail.sh # Silent4Labs (risk assessment)
├── ansible/
│ ├── ansible.cfg # (optional) Ansible configuration
│ ├── inventory.ini # Server inventory
│ └── mitigation.yml # Main playbook
└── resultados_cve/ # Auto‑generated folder for logs
git clone https://github.com/your-username/cve-2026-31431-mitigation.git
cd cve-2026-31431-mitigation/ansible
inventory.ini)Example for a remote server:
[servers]
server1 ansible_host=192.168.1.10 ansible_user=root
[localhost]
localhost ansible_connection=local
[all:vars]
ansible_become=yes
# ansible_become_password=my_password # if using password for sudo
In mitigation.yml, the task Copy scripts to remote uses src: "../scripts/{{ item }}". Make sure the relative path is correct, or modify it according to your layout.
From the ansible/ directory:
ansible-playbook -i inventory.ini mitigation.yml -k -K
-k asks for the SSH password.-K asks for the become (sudo) password.When using localhost with ansible_connection=local, no SSH is needed.
The playbook displays a plain‑text summary similar to:
==========================================
MITIGATION RESULTS
==========================================
Host: server1
------------------------------------------
- Status: SYSTEM SECURE
- Code: (not applicable)
------------------------------------------
- Final score: 40 / 100
- Risk level: MEDIUM
==========================================
Additionally, a log file is saved in resultados_cve/<hostname>_mitigation.log containing the full script output (date, kernel version, detection messages, etc.).
If extracted values show ? or Not detected, enable the debug tasks in mitigation.yml:
when: false to when: true in the three DEBUG tasks (or set when: true to view clean_stdout and regex outputs).Edit the tasks Create local results directory and Save full output to local file:
path: /absolute/path/resultados_cve
dest: "/absolute/path/resultados_cve/{{ inventory_hostname }}_mitigation.log"
Comment out the copy tasks and adjust the path in the Run mitigation script task to point to the existing location.
Change when: false to when: true in the last task (Clean up remote scripts).
initcall_blacklist) requires a reboot to take effect. The playbook does not reboot automatically; a maintenance window must be planned.CONFIG_CRYPTO_USER_API_AEAD=y (built‑in kernel), the module cannot be unloaded with rmmod; the only way is the boot parameter./proc/crypto and /boot/config-*; they run with become: yes.This project is distributed under the MIT license. Third‑party scripts (Phalanx-CCS, Silent4Labs) retain their respective licenses.
If you find this tool useful, please consider giving it a star on GitHub!
