Post #1848690
2026-04-30 10:35 UTC
@JennyFluff@chitter.xyz You can `echo 1 > /proc/sys/vm/drop_caches` to drop the caches, after you've done something like:
$ cd /etc/modprobe.d
$ cat > af_alg.conf
blacklist af_alg
blacklist algif_aead
$
which blacklists the modules. Now, if you have legitimate use of af_alg, you can decide to only `blacklist algif_aead`, which worked to block the exploit on my Debian 13/trixie desktop running a locally-compiled 6.18.25 kernel.
Dropping the caches clears what the exploit did (changing the contents of the cached version of `/usr/bin/su`, so that cached version is always used, not the on-disk version).
#copyfail
Replies (1)
-
@AthanSpod@social.linux.pizza 2026-05-01 14:33
@JennyFluff@chitter.xyz I should also note that if you want to be *certain* nothing will cause the module to load, the above only stops auto-loading on-demand. To stop it loading at all you'd use this instead of the blacklist line: install algif_aead /usr/bin/false which causes modprobe/insmod/the-kernel to run /usr/bin/false rather than load the module. This way a manual *or scripted* modprobe/insmod can't just load it anyway.