CVE-2026-31431 - Copy Fail - Linux kernel crypto vulnerability

quocbao · May 4, 2026, 9:30am

Hi guys,

I have made a temporary workaround using eBPF while waiting for official patches or maintainace window time to restart servers.

github.com/theori-io/copy-fail-CVE-2026-31431

Add workaround using eBPF for systems that can not be rebooted (#119)

main ← baonq-me:main

opened 08:54AM - 04 May 26 UTC

baonq-me

+104 -0

## Overview This PR add a workaround that use eBPF (require `bcc/python3-bpfc…c`) to intercept processes creating AF_ALG sockets (socket family 38), then immediately SIGKILLs (terminates) the calling process. Tested on `Rocky 9.3` using linux kernel version `5.14.0-362.18.1.el9_3.x86_64` Inspired by mattmix's systemtap script at https://github.com/theori-io/copy-fail-CVE-2026-31431/issues/30#issuecomment-4349469616 ## How to Running <img width="1462" height="232" alt="CleanShot 2026-05-04 at 15 47 14@2x" src="https://github.com/user-attachments/assets/f4c4cbdc-771d-41df-8344-b8b06fdd1848" /> The test script is killed before having any chance <img width="976" height="152" alt="CleanShot 2026-05-04 at 15 47 49@2x" src="https://github.com/user-attachments/assets/387039ab-1c45-42e5-bbe8-7ddcc1135741" />

Wishes to receive feedbacks. Thanks all.

Topic		Replies	Views
Fragnesia - CVE-2026-46300 Rocky Linux Help & Support	32	4101	June 5, 2026
CopyFail (CVE-2026-31431): Patches Now Available for Rocky Linux Announcements rocky-linux-8 , rocky-linux-9 , rocky-linux-10	2	6206	May 8, 2026
Dirty Frag vulnerability reported for Linux kernel CVE-2026-43284, CVE-2026-43500 Rocky Linux Help & Support rocky-linux-8 , rocky-linux-9 , rocky-linux-10	10	5577	May 14, 2026
Rocky 8.10 - CVE-2025-38352 Rocky Linux Help & Support rocky-linux-8	23	1886	September 22, 2025
Is CVE-2026-46243 fixed in RockyLInux 9.7? Rocky Linux Help & Support	14	448	June 5, 2026

CVE-2026-31431 - Copy Fail - Linux kernel crypto vulnerability

Related topics