Post #1819795

2026-04-29 20:11 UTC

37 days after the vulnerability was reported to the #linux kernel security team ... 34 days after kernel patch Reported-by: &quot;0wn @ [vulnerability research org]&quot; ... 7 days after a conspicuously-vague CVE announcement... No patches from #Ubuntu #debian #redhat #fedora

Replies (2)

@marshray@infosec.exchange 2026-04-29 22:21

This is what I'm pasting into my own linux systems to implement the mitigation #cve_2026_31431 suggested at the #copyfail website. It may not be right for you. The 'chattr +i' may make it more difficult to undo! MIT license, or at least its disclaimers, apply. f=disable-algif_aead-CVE-2026-31431.conf if ! [ -d /etc/modprobe.d ]; then printf 'This system does not seem to have a /etc/modprobe.d dir, so this script would need to be adapted.\n' >&2 return 74 else sudo /bin/env -i /bin/sh -c 'set -x;set -e;cd /etc/modprobe.d;umask 133;printf '\''install algif_aead /bin/false\n'\'' >'"$f"';chattr +i '"$f" fi sudo /bin/env -i /bin/sh -c '(set -x;rmmod -v algif_aead)2>&1|grep -v "is not currently loaded"' ls -l /etc/modprobe.d/$f cat -t /etc/modprobe.d/$f

Open ##2100399
@adamw@fosstodon.org 2026-04-29 23:39

@marshray doesn't work on vaguely recent F44 kernel for me. [adamw@omnibook ~]$ curl -o /tmp/test.py https://raw.githubusercontent.com/theori-io/copy-fail-CVE-2026-31431/refs/heads/main/copy_fail_exp.py [adamw@omnibook ~]$ python3 /tmp/test.py Password: su: Authentication failure [adamw@omnibook ~]$ uname -r 6.19.13-300.fc44.x86_64

Open ##2100400