Copy Fail (CVE-2026-31431) Diagnosis & Fix Guide: Is Your Server Compromised?

The previous article covered how serious this vulnerability is. Now let’s get practical — how to check if your system is affected, how to fix it, and what to do in an emergency.

One thing upfront: If your server is shared by multiple users or runs containers, check immediately. The PoC is public, scripted, and requires minimal skill.

Three-Step Quick Check

Step 1: Check Kernel Version

uname -r

Compare against the following safe versions table:

If your version is lower than the safe version, your system may be affected — proceed to Step 2.

Step 2: Check Kernel Configuration

The vulnerability requires the CONFIG_CRYPTO_USER_API_AEAD kernel configuration option to be enabled.

grep CONFIG_CRYPTO_USER_API_AEAD /boot/config-$(uname -r)

There are three possible results:

Step 3: Check Module Loading Status

If the configuration is set to “m” (module), you need to check if the AF_ALG AEAD module is currently loaded:

lsmod | grep algif_aead

If the module is loaded, your system can currently exploit this vulnerability. If not loaded, but accessible to unprivileged users, they could load it via:

modprobe algif_aead

On most systems, loading kernel modules is root-only by default (controlled by the kernel.modules_disabled sysctl or module permissions). But some cloud or container environments have looser settings.

Fixing the Vulnerability

Method 1: Upgrade the Kernel (Recommended)

Ubuntu/Debian

sudo apt update
sudo apt list --upgradable | grep linux-image
sudo apt upgrade -y
sudo reboot

After reboot, verify:

uname -r

RHEL/Rocky Linux

sudo dnf update kernel
sudo reboot

Amazon Linux 2023

sudo dnf update kernel
sudo reboot

Method 2: Live Patching (No Reboot Required)

If you can’t reboot immediately, some distributions offer live patching:

Ubuntu (Canonical Livepatch)

sudo snap install canonical-livepatch
sudo canonical-livepatch enable your-key
sudo canonical-livepatch status --verbose

RHEL (kpatch)

sudo kpatch list

General (KernelCare or similar)

Third-party live patching tools like KernelCare also support this vulnerability.

Method 3: Immediate Mitigation (If No Patch Available)

If you can’t upgrade or apply a live patch, you can reduce risk:

Option A: Blacklist the Module

Create /etc/modprobe.d/blacklist-algif_aead.conf with content:

blacklist algif_aead

Then run:

sudo rmmod algif_aead

Note: This only prevents the module from loading. If other kernel components (like WireGuard, IPsec) require the crypto AEAD interface, disabling the module may affect them.

Option B: Restrict AF_ALG Socket Access

Use LSM or seccomp to block unprivileged users from creating AF_ALG sockets. For example, using AppArmor or SELinux to limit socket(AF_ALG, …) calls.

Option C: Container-Level Restrictions

For container environments, restrict the --privileged flag and drop SYS_MODULE capability to prevent container users from loading kernel modules. Also add seccomp profiles to block AF_ALG socket creation.

Compromise Detection Checklist

If you suspect your server has been compromised by this vulnerability, check the following:

• Check setuid binaries for anomalies: sudo find /usr -type f ( -perm -4000 -o -perm -2000 ) -exec sha256sum {} ; and compare against a known-good list
• Check journalctl for signs of exploitation: sudo journalctl -k | grep -i 'AF_ALG|algif_aead|splice|page cache'
• Check for unusual sudo/su usage: sudo ausearch -m USER_AUTH --success yes | tail -50 — look for non-admin users suddenly executing root commands
• Check for unknown cron jobs or systemd timers: sudo crontab -l and systemctl list-timers --all — look for unexpected persistence mechanisms
• Check kernel module load history: sudo journalctl -k | grep 'module_load|algif' — look for suspicious module loading patterns

FAQ

1. Does disabling the module definitely mitigate the vulnerability?

If CONFIG_CRYPTO_USER_API_AEAD=m and the module is not loaded, and non-root users cannot load it, then the attack surface is significantly reduced. But if the configuration is =y (statically compiled), blacklisting the module is ineffective — you must upgrade the kernel.

2. Does this affect containers?

Yes, especially seriously. If you have an unprivileged container user who can create AF_ALG sockets (which is allowed by default in many container runtimes), and the kernel hasn’t been patched, they can escape to the host. Container environments should prioritize patching.

3. Does this affect WSL2?

WSL2 uses a real Linux kernel. If your WSL2 kernel is compiled with CONFIG_CRYPTO_USER_API_AEAD enabled and within the affected version range, it is also exploitable. Check your WSL2 kernel version and update.

Emergency hot take: Upgrade the kernel first, blacklist the module second. If you absolutely can’t reboot, apply seccomp to block AF_ALG sockets — but don’t rely on this as a permanent solution. The fix is already in the kernel tree, and major distributions have released updates. Just apt upgrade && reboot.