#cve_2026_31431

Fresh gist: mitigating CVE-2026-31431 ("Copy Fail") on RHEL 8/9/10 with a tiny Ansible playbook. It blacklists algif_aead via a kernel boot arg (initcall_blacklist=algif_aead_init), reboots only when needed, and asserts the mitigation actually stuck after reboot. Idempotent & safe to re-run. https://codeberg.org/Larvitz/gists/src/branch/main/2026/20260501-CVE-2026-31431_RHEL_Mitigation.md #Ansible #RHEL #Linux #InfoSec #SysAdmin #DevOps #CVE #CVE_2026_31431 #copyfail

#debian has released a new Debian 13 (Trixie) kernel to fix #cve_2026_31431. If you aren't on Trixie yet, maybe a good time to upgrade? #sysadmin #homelab #linux

Mitigation to #CVE_2026_31431 / #copyfail :

• If kernel config has CONFIG_CRYPTO_USER_API_AEAD=m:

echo "install algif_aead /bin/false" | sudo tee /etc/modprobe.d/disable-algif.conf; sudo rmmod algif_aead

• If kernel config has CONFIG_CRYPTO_USER_API_AEAD=y:

Add "initcall_blacklist=algif_aead_init" to the kernel command line and reboot.

https://www.openwall.com/lists/oss-security/2026/04/30/2

Si sois sysadmins de Linux mejor no hagáis planes para el puente... https://copy.fail/ #copyfail #cve_2026_31431