Anything being done about NVD - CVE-2026-31431 ?

I’ll answer myself: Mitigation doesn't work on RHEL 9.4 opened 02:57AM - 30 Apr 26 UTC (UTC) [image] FrancisTurner Using either rmmod or modprobe resu…

So this is not Zero Day vulnerability ? Its imporant

It is a zero day vulnerability, but the bad guy has to have access to your machine (either local or remote) before he can use it. It’s not a vulnerability that allows any random schmoe to log into your computer unless he already has a way to do it. It just allows him to jack up his access level if…

I added the following line to /etc/default/grub: GRUB_CMDLINE_LINUX=“initcall_blacklist=algif_aead_init” then did a sudo grub2-mkconfig -o /boot/grub2/grub.cfg upon reboot the exploit no longer works. The failure message is: AttributeError: module ‘os’ has no attribute ‘splice’. You would probabl…

[image] fauxgotten: upon reboot the exploit no longer works. The failure message is: AttributeError: module ‘os’ has no attribute ‘splice’. You would probably want to revert this change once a patched kernel is released. If on Rocky 9, that is because of python version is less than 3.10. The…

Hello, Update copy_fail_exp.py (#66) main ← danielino:main opened 12:02PM - 30 Apr 26 UTC (UTC) [image] danielino …

Sad to report that using 3.12, it is still exploit is still there when tested with 3.12 rather than the default :cry:. Wonder if the security researcher that said this was a fix also had the same issue?

Hello, The example is in python, but you can write the same thing in whatever language .. maybe in Ruby or other. The python script just permit to “easily” show the exploit.

For the time being we just have to wait until the appropriate packages are updated with fixes, eg: new kernel. As already said by @FrankCox the impact probably isn’t that bad considering it requires someone to actually have access to your server with an existing account.

I tried to run this in one of my rocky linux 8.10 container and did not actually su into root. Does it impact to specific Rocky version ( I saw 9) or all ? Does anyone know?

CVE-2026-31431 - Copy Fail - Linux kernel crypto vulnerability

Rocky Linux Help & Support

henri9813 April 30, 2026, 6:21pm 10

Hello,

This PR permit to test. I confirm Rocky 9 is impacted.

Topic		Replies	Views
CopyFail (CVE-2026-31431): Patches Now Available for Rocky Linux Announcements rocky-linux-8 , rocky-linux-9 , rocky-linux-10	2	1103	May 8, 2026
Rocky 8.10 - CVE-2025-38352 Rocky Linux Help & Support rocky-linux-8	24	1725	November 21, 2025
The Further Experiments of a Vacuous Experimenter Rocky Linux Help & Support	9	693	August 25, 2023
Trouble in River City -- Rocky Linux 8.5 Rollover Blew Up Rocky Linux Help & Support	17	2135	August 25, 2023
Some errata missing in comparison with RHEL and AlmaLinux Rocky Linux Help & Support	16	4356	August 25, 2023

CVE-2026-31431 - Copy Fail - Linux kernel crypto vulnerability

Related topics