CVE-2026-31431 (Copy Fail): KernelCare Live Patches Released

Go straight to an AI summary of this blog post instead

CVE-2026-31431 (“Copy Fail”) is a Linux kernel local privilege escalation in the algif_aead module (AF_ALG). Any unprivileged local user can gain root with a 732-byte Python exploit. All kernels since 2017 are affected.

KernelCare engineering validated the fix against the published exploit on AlmaLinux 9.6-FIPS and Oracle UEK7, then released live patches across the operating systems listed below. Customers do not need to schedule a maintenance window or wait for the next vendor errata. The patch applies to the running kernel and takes effect without a reboot.

Background: copy.fail · Xint write-up · NVD · Upstream fix

Why this is urgent

The exploit is small (732 bytes), publicly available, and reliable. It targets a flaw introduced upstream in 2017, so the affected fleet covers RHEL, CentOS, AlmaLinux, Rocky Linux, Oracle Linux, Ubuntu, Debian, Proxmox VE, and CloudLinux running supported kernels. The compromise pathway is a clean local-to-root escalation with no authentication requirement.

On any system where untrusted users can execute code (shared hosting, multi-tenant platforms, CI runners, container hosts where escapes are a concern), this should be treated as a same-day patching event.

KernelCare live patches: available now, no reboot

KernelCare engineering identified the full fix set (three upstream commits, not just the algif_aead revert), validated it against the published exploit on AlmaLinux 9.6-FIPS and Oracle UEK7, and rolled out live patches across all supported distributions ahead of vendor erratas. Customers receive the fix automatically on their next kcarectl --update.

Live patches for CVE-2026-31431 are released for the following operating systems:

almalinux8
almalinux9
cloudlinux7h
cloudlinux8
centos8
redhat8
redhat9
proxmox-ve-7-5.15
ubuntu-focal-lts-jammy-aws
ubuntu-focal-lts-jammy
ubuntu-focal-lts-jammy-azure
ubuntu-jammy-aws
ubuntu-jammy-azure
ubuntu-jammy
ubuntu-bionic-lts-focal
ubuntu-bionic-lts-focal-aws
ubuntu-focal-azure
ubuntu-focal-aws
ubuntu-focal
rockylinux8
rockylinux9
oraclelinux8
oraclelinux8-uek6
oraclelinux7-uek6
oraclelinux9
debian11
debian12

ELS for FIPS kernels are also covered

TuxCare’s Endless Lifecycle Support FIPS-validated kernels for AlmaLinux 9.2 and 9.6 are patched as well. ELS-FIPS customers receive the fix through the same KernelCare feed (releases K20260430_13 and K20260430_07 respectively) with no separate action required.

What KernelCare customers need to do

In most cases, nothing. If kcarectl auto-update is enabled (the default), the patch is fetched and applied on the next scheduled poll. To apply it immediately:

kcarectl --update

How to verify you are patched

Confirm the live patch is loaded:

kcarectl --patch-info | grep -i 'CVE-2026-31431\|algif_aead\|copy.fail'

A matching entry confirms protection. The kernel version string returned by uname -r does not change with KernelCare, since the running kernel is patched in memory rather than replaced on disk.

Temporary mitigation (if you cannot update immediately)

If applying the KernelCare live patch is not possible right now, you can blacklist the algif_aead initcall via grubby. This prevents the AEAD AF_ALG interface from being registered at boot and closes the attack surface without replacing the kernel. Requires a reboot.

Apply the restriction and reboot:

sudo grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"
sudo reboot

After reboot, confirm the parameter is on the active kernel command line:

sudo grubby --info=ALL | grep initcall_blacklist

To revert once the live patch is applied:

sudo grubby --update-kernel=ALL --remove-args="initcall_blacklist=algif_aead_init"
sudo reboot

Compatibility: dm-crypt / LUKS, kTLS, IPsec, SSH, and default OpenSSL / GnuTLS builds do not depend on AF_ALG and are unaffected. Only applications that explicitly use AF_ALG for AEAD ciphers (for example, OpenSSL with the afalg engine enabled, or hardware crypto offload via AF_ALG) will be impacted.

Warning: the modprobe workaround does not work

The mitigation circulating on oss-security, adding install algif_aead /bin/false to a file under /etc/modprobe.d/ and running rmmod algif_aead, does not work on RHEL-family distributions (RHEL, CentOS, AlmaLinux, Rocky Linux, Oracle Linux, CloudLinux) or on most other major distributions.

algif_aead is built into the kernel (CONFIG_CRYPTO_USER_API_AEAD=y), so modprobe.d rules cannot block its loading and rmmod cannot remove it. The commands run without errors but leave the system unchanged, giving a false sense of protection.

You can confirm the module is built in:

modinfo algif_aead | grep filename
# (builtin)

Use the grubby-based mitigation above instead.

Links

Not using KernelCare yet?

KernelCare delivers live patches for kernel CVEs to running systems with no reboot and no maintenance window. The same delivery model that closed CVE-2026-31431 ahead of vendor erratas applies to every high-severity kernel CVE going forward.

Start a free trial now

Summary