334
Serious Linux vulnerability affecting nearly every system. Patch your systems. (copy.fail)
submitted 4 months ago by to c/selfhosted@lemmy.world
74 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 13 points 4 months ago* (last edited 4 months ago) (3 children)

Check uname -r

If you're on 6.19.12 or newer (7.0.1 if they've already bumped to 7) you're definitely safe

For others, it looks fixed in 6.18.22 6.12.85 6.6.137 6.1.170 5.15.204

If you don't have a safe kernel, A better solution referenced below than a module blacklist is to set initcall_blacklist=algif_aead_init in your kernel boot parameters. There is not a generic way to do this across distros, so you will need to look it up for your case

~~If you don't have the updated kernel, you can echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf and reboot.

That ensures the buggy module cannot be loaded until you have an updated kernel~~

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 8 points 4 months ago (1 child)

    I continue to protest against this claim. Blacklisting the kernel module does not work for a bunch of distributions including Alma, Rocky, RHEL and others because they have this module built into the kernel. There's no module to remove. You must use a syscall blacklist or similar mechanism to disable this.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 6 points 4 months ago* (last edited 4 months ago) (1 child)

    I'm working off the knowledge that OP is using a rolling release, so is likely fixed by that for them. (Arch based, Cachy, and OpenSUSE Tumbleweed all have it as a module, and are the most commonly suggested. Fedora fixed it 2 weeks ago since they follow mainline, so I'd expect Bazzite to have it too. If they're using Debian Sid/Testing, it's both fixed and a module)

    If you're using something else, this eBPF filter is probably your best bet https://github.com/Dabbleam/CVE-2026-31431-mitigation

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 5 points 4 months ago (1 child)

    My personal suggestion would be to add initcall_blacklist=algif_aead_init to your kernel arguments. Ebpf is cool, but not a very trivial solution.

    I understand the suggestion might apply to a random, unspecified distro but I disapprove of both the exploit authors and the general Internet suggesting fixes that don't apply to every distro (including copy.fail's AI slop RHEL distro that doesn't exist) without caveating it.

    The kernel module blacklist won't work for every situation, if you're not being specific in telling people where it applies, it's best to suggest a solution that actually works regardless of distro or explain how to validate when it applies but nobody is doing that.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 4 months ago (1 child)

    You could just install security updates

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 15 points 4 months ago (1 child)

    They aren't available on all releases - the people that found the issue didn't really follow responsible disclosure, so distros didn't have time to fix it

    They will fix it over the next couple days, but if you need a fix now, those are the ways to protect yourself until security updates make it out

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •