Post #1801933

2026-04-29 21:46 UTC

@darkrat I wonder how much is trying to create a panic and how much is a serious issue right now (for those who patch regularly). My debian machines don't have the algif_aead module loaded (and it's CONFIG_CRYPT_AEAD=m in default debian kernel, i *guess* that's the right setting). That said debian lists it as vulnerable... https://security-tracker.debian.org/tracker/CVE-2026-31431

Replies (5)

@human_equivalent@rage.love 2026-04-29 22:06

@darkrat According to reddit it's CONFIG_CRYPTO_USER_API_AEAD and it can be checked like this; grep CONFIG_CRYPTO_USER_API_AEAD /boot/config-$(uname -r)

Open ##1801934
@aburka@hachyderm.io 2026-04-29 22:41

@human_equivalent @darkrat it works in the stock Ubuntu Noble docker image fwiw

Open ##1801935
@dalias@hachyderm.io 2026-04-29 23:09

@human_equivalent @darkrat Not being loaded doesn't help. The exploit causes the kernel to automatically load the module to satisfy the request. You have to block loading of it to be safe.

Open ##1801936
@privateger@plasmatrap.com 2026-04-30 00:02

@human_equivalent@rage.love @darkrat@chaosfurs.social worked perfectly on my debian-proxmox server, so I'm inclined to believe debian in general is affected

Open ##1801937
@drwho@masto.hackers.town 2026-04-30 01:09

@human_equivalent @darkrat I'm kinda leaning toward "make everybody panic" right now. I might be wrong but so far this is a NOP.

Open ##1801938