Microsoft Issues Warning About Linux 'Copy Fail' Vulnerability

joshuark shares a report from Linux Magazine: Microsoft has issued a warning that a vulnerability with a CVSS score of 7.8 has been found in the Linux kernel. The vulnerability in question is tagged CVE-2026-31431 and, according to the Cybersecurity and Infrastructure Security Agency (CISA), "This Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise."

The distributions affected are Ubuntu, Red Hat, SUSE, Debian, Fedora, Arch Linux, and Amazon Linux. This could also affect any distribution based on those in the list, which means pretty much every Linux distro that isn't independent. The flaw is found in the Linux kernel cryptographic subsystem's algif_aead module of AF_ALG. The problem is that a particular optimization has led to the kernel reusing the source memory as the destination during cryptographic operations. What this means is that attackers can take advantage of interactions between the AF_ALG socket interface and a splice() system call. Until patches are released, Microsoft is advising that the affected crypto feature should be disabled, or AF_ALG socket creation should be blocked. The vulnerability is also known as "Copy Fail," which has been shared on Slashdot and detailed in a technical report. The vulnerability affects almost every version of the Linux OS and is now being exploited in the wild. U.S. cybersecurity agency CISA has ordered all civilian federal agencies to patch any affected systems by May 15.

Re:Friendly reminder

[txsable]

First, the report is a few days late....

Second, the /etc/modprobe.d mitigation DOES NOT WORK on Red Hat Enterprise Linux. The affected module is compiled into the kernel, and must be disabled using kernel boot parameters.

implement: grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"
reboot required
verify: cat /proc/cmdline | grep initcall_blacklist
revert: grubby --update-kernel=ALL --remove-args="initcall_blacklist=algif_aead_init"

Kernel updates for RHEL 8,9 and 10 have been released. Ubuntu hasn't released anything except kmod fixes yet.

Re:

[Valgrus Thunderaxe]

The affected module is compiled into the kernel,

Why?

Re: Friendly reminder

[FudRucker]

I agree, the only modules that should be embedded into the kernel is the filesystem module and the SATA module = just enough to get the kernel to boot up the OS without needing an initrd.gz, it's been a few years since I built my own but I used to have a sweet recipe for rolling my own kernel

Re:

[Narcocide]

No. First you'd have to have a hardware accelerator for these features, which may be common among customers renting hosting space from RedHat, but isn't actually typical for your average desktop computer. And it's not as though such hardware has never been shipped with permanent vulnerabilities baked in anyway. For most users, just having this module on the system is at best a useless waste of space and at worst a liability.

Re: Friendly reminder

[Sneftel]

Hm? Wasnâ(TM)t AES-NI introduced in Sandy Bridge?

Re:

[Valgrus Thunderaxe]

Because it's tiny and gives hardware acceleration to a function 100% of users need.

My uptime, on the machine I'm posting from, is nearing a year, and this module has never been loaded. So, no, 100% of users apparently don't need this, at all.

Re:

[F.Ultra]

zero of those use the kernel provided AES so no.

Re:

[Himmy32]

Noting that the unlinked Microsoft Article [microsoft.com] itself does link to the Red Hat article [redhat.com] and NVD with its own links [nist.gov]. And that Microsoft's specific guidance is:

• Identify all instances of affected products/versions in your environment.
• Apply mitigation based on patch availability:
• • If patches exist, apply immediately. Links to security bulletins and vendor patches are available at NVD – CVE-2026-31431.
  • If no patches exist, choose one of these interim mitigations:
  • • Disable affected feature
    • Implement network isolation
    • Apply access controls
  • Review logs for signs of exploitation.

Because this vulnerability impacts a large swath of Linux devices, it is strongly recommended to do the following:

• Patch or update your distribution’s kernel packages or to block AF_ALG socket creation.
• Treat any container RCE as potential host compromise and enforce rapid node recycling after compromise indicators.

Shocked, a late security announcement from MS

[drnb]

First, the report is a few days late....

I am shocked that a security announcement from MS is late. :-)

Re:

[Himmy32]

The Microsoft article was posted on May 1st [archive.org] and links to the Red Hat article (for which the solution is behind their paywall). And directs people to apply the vendor's patches or guidance if possible instead of manual settings changes.

Re: Friendly reminder

[iabervon]

While you're at it, you also need to block installing esp4, esp6, and rxrpc, for, y'know, reasons.

What gives?

[CAIMLAS]

This is literally the third /. mention of this in a very short period of time, nevermind the fact that it's been broadcast literally everywhere and is the biggest security vuln found since sliced bread (or heartbleed). It's been fixed and available for "ages" now on every major distro.

Re:

[nightflameauto]

This is literally the third /. mention of this in a very short period of time, nevermind the fact that it's been broadcast literally everywhere and is the biggest security vuln found since sliced bread (or heartbleed). It's been fixed and available for "ages" now on every major distro.

One would almost begin to suspect that there is a vested interest in making Linux appear to be far more vulnerable than the "alternatives" to Linux.

Re:

[HiThere]

Not for ages. Less than a week. For many, that's not time enough to get the patch.

OTOH, it's a local vulnerability, so many systems aren't affected. I've got one that hasn't been hooked up to the internet in well over a month, and it won't be affected until the next time it's hooked up. (I may do a reinstall before then.)

Re:

[dinfinity]

Also, why the fuck is it news that Microsoft is posting about it? TFS or TFA give absolutely no indication as to why.

This is just a dupe, nothing more.

Re:

[Cpt_Kirks]

Also, why the fuck is it news that Microsoft is posting about it? TFS or TFA give absolutely no indication as to why.

This is just a dupe, nothing more.

Because M$ is THE EXPERT on vulnerabilities.

Re:

[znrt]

our apologies, sir. would you prefer a slashvertisement instead?

Re:

[bloodhawk]

Not really ages, a week. mind you the article they are talking about is a week old and related to Microsoft Defender which is used by customers to monitor cloud servers, many of which are unsuprisingly linux. So while this slashdot article seems to try and imply it is MS pointing fingers, it is nothing of the sort. It is just a standard blog article warning its userbase of an at the time very serious vulnerability, why it is here a week later on slashdot is another question.

Naughty EU

[sit1963nz]

How dare you dump Microslop for Linux....

Pffft...

[dskoll]

Old news and 3 times on Slashdot. The new kids have already moved on to Dirty Frag [github.com], a new Linux local privilege escalation vulnerability.

Re:

[93 Escort Wagon]

The new kids have already moved on to Dirty Frag [github.com], a new Linux local privilege escalation vulnerability.

Question is, who's the jackass that broke the embargo on this one?

Not news

[Himmy32]

The article doesn't even link to the Microsoft article [microsoft.com], which is on the Microsoft Defender blog. This isn't a huge surprise since that's Microsoft's security product that covers cloud servers including in Azure, AWS and GCP [microsoft.com].

So the sub-text of this being Microsoft pointing out Linux vulns is pretty silly since Microsoft makes a lot of money off of people running Linux on their cloud and on their competitors' kit. Outside of that, the rest of this has already been covered.

Just wait until they discover dirty frag

[CloneRanger]

https://dirtyfrag.io. Nearly the same vulnerability, different access vector.