Post #2006513

Slackware Patches "Copy Fail" Kernel Bug — CVE-2026-31431Slackware has issued a kernel security update for CVE-2026-31431, the Copy Fail vulnerability disclosed April 29, 2026. It's an out-of-bounds write in the AEAD userspace crypto interface (AF_ALG) that lets any local user get a root shell via a setuid binary — the same 732-byte Python PoC works on essentially every Linux distro shipped since 2017. If you can't patch right away, Slackware ships the affected code as a module (CONFIG_CRYPTO_USER_API_AEAD=m), so you can blacklist or remove it as a stopgap: echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf rmmod algif_aead For most systems this breaks nothing — AF_ALG is a userspace front-door to the kernel crypto API, and OpenSSL, SSH, dm-crypt, kTLS, and IPsec all bypass it. Patch and reboot when you can. slackpkg update && slackpkg upgrade-all. Sources: http://www.slackware.com/security/viewer.php?l=slackware-security&y=2026&m=slackware-security.1267034https://www.cve.org/CVERecord?id=CVE-2026-31431#slackware #copyfail