Copy Fail – CVE-2026-31431

Re:Copy Fail – CVE-2026-31431 by john_strinlai on Wednesday April 29, 2026 @03:25PM (#47953169)

Disclosure timeline

    2026-03-23Reported to Linux kernel security team
    2026-03-24Initial acknowledgment
    2026-03-25Patches proposed and reviewed
    2026-04-01Patch committed to mainline
    2026-04-22CVE-2026-31431 assigned
    2026-04-29Public disclosure (https://copy.fail/)

kernel 6.19.14-arch1-1, the kernel in question from the parent comment, has been patched.

[ Parent | on HN ]

Re:Copy Fail – CVE-2026-31431 by marshray on Wednesday April 29, 2026 @04:41PM (#47954314)

The lesson here being... compile your own kernel from git sources every few days?

Give up entirely on non-virtualized container security?

This is not sarcasm. I'd finally given in and started learning about docker/podman-style OCI containerization last week.

[ Parent | on HN ]

Re:Copy Fail – CVE-2026-31431 by john_strinlai on Wednesday April 29, 2026 @04:46PM (#47954365)

in this specific case, they offer an alternative mitigation if your chosen distro has not updated yet:

For immediate mitigation, block AF_ALG socket creation via seccomp or blacklist the algif_aead module:

    echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf
    rmmod algif_aead 2>/dev/null

[ Parent | on HN ]

Re:Copy Fail – CVE-2026-31431 by marshray on Wednesday April 29, 2026 @05:11PM (#47954725)

Thanks!

I'd do 'umask 133' in front of the echo out of paranoia.

Out of curiosity, was the asterisk after '2>/dev/null' intentional? I had not seen that idiom before.

[ Parent | on HN ]

Re:Copy Fail – CVE-2026-31431 by john_strinlai on Wednesday April 29, 2026 @05:13PM (#47954759)

the asterisk is my oops, trying to format the comment in italics to differentiate my comment from the text provided by the author. sorry for the confusion

[ Parent | on HN ]

Re:Copy Fail – CVE-2026-31431 by ranger_danger on Wednesday April 29, 2026 @05:24PM (#47954919)

And I would do chattr +i disable-algif.conf

[ Parent | on HN ]

Re:Copy Fail – CVE-2026-31431 by x4132 on Wednesday April 29, 2026 @08:38PM (#47956577)

are you sure containerization would be more secure? this is also a rootless podman escape. the lesson here is to not give random people shell access to your systems.

[ Parent | on HN ]

Re:Copy Fail – CVE-2026-31431 by marshray on Saturday May 02, 2026 @12:32AM (#47983318)

No, I meant that I'd resisted doing anything with Docker for its entire existence and just finally gave in and started messing with podman.

I have amazing timing.

[ Parent | on HN ]

Re:Copy Fail – CVE-2026-31431 by DooMMasteR on Thursday April 30, 2026 @09:55AM (#47962568)

I mean, most Kernel version literally got the patch 2026.04.30, so just today.

[ Parent | on HN ]