[Security] CVE-2026-31431 (Copy Fail)

CVE-2026-31431 has been made public. This affects majority of Linux Operating Systems. Nectar images that are affected includes (but are not limited to):

This is a local privilege escalation (to root) vulnerability. If you have unprivileged users on your systems, you will need to mitigate/fix this to prevent them from gaining root.

As of time of writing, there are no patched packages from Ubuntu. We will provide an update if this changes.

Mitigations

1. Using modprobe

You can mitigate this in Ubuntu with the following commands. As root, run

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
reboot

This mitigation works for distributions that has algif_aead as a dynamic kernel module. This does not work for distributions that have algif-aead compiled into kernel (e.g. RHEL)

2. Using grub

For distributions that have compiled the module into kernel, you can prevent the blacklist the module via the `initcall_blacklist` config in grub

If you have grubby, you can do

grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"

If not, you can edit /etc/default/grub, and append the following 

GRUB_CMDLINE_LINUX="... initcall_blacklist=algif_aead_init"

and run `sudo update-grub` after editing

NOTES

Mitigations are not a fix. The proper fix requires a new kernel, which currently does not exist The different mitigations come with varying level of completeness. It is important that you decide what is right for you.

Out of all the mitigations, we believe that blacklisting using grub is superior, as it occurs at an earlier sequence in kernel, and works for both kernel modules and in-kernel.

We will update this post as more information becomes available.

0 Votes