upvote

points

by TehCorwiz18 hours ago |
comments
upvoteby john_strinlai18 hours ago|
next
[-]
yes, it was reported on march 23rd, patches on april 1.

you are reading about it now because it has been patched.

reply
upvoteby marshray18 hours ago|
parent|
[-]
No it hasn't.

Ubuntu before 26.04 LTS (released a week ago) are currently listed as vulnerable.

Debian other than forky and sid are currently listed as vulnerable.

This is a disgrace.

reply
upvoteby john_strinlai17 hours ago|
parent|
[-]
Disclosure timeline

    2026-03-23Reported to Linux kernel security team
    2026-03-24Initial acknowledgment
    2026-03-25Patches proposed and reviewed
    2026-04-01Patch committed to mainline
    2026-04-22CVE-2026-31431 assigned
    2026-04-29Public disclosure (https://copy.fail/)
kernel 6.19.14-arch1-1, the kernel in question from the parent comment, has been patched.
reply
upvoteby marshray16 hours ago|
parent|
[-]
The lesson here being... compile your own kernel from git sources every few days?

Give up entirely on non-virtualized container security?

This is not sarcasm. I'd finally given in and started learning about docker/podman-style OCI containerization last week.

reply
upvoteby john_strinlai16 hours ago|
parent|
next
[-]
in this specific case, they offer an alternative mitigation if your chosen distro has not updated yet:

For immediate mitigation, block AF_ALG socket creation via seccomp or blacklist the algif_aead module:

    echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf
    rmmod algif_aead 2>/dev/null
reply
upvoteby marshray16 hours ago|
parent|
[-]
Thanks!

I'd do 'umask 133' in front of the echo out of paranoia.

Out of curiosity, was the asterisk after '2>/dev/null' intentional? I had not seen that idiom before.

reply
upvoteby john_strinlai16 hours ago|
parent|
next
[-]
the asterisk is my oops, trying to format the comment in italics to differentiate my comment from the text provided by the author. sorry for the confusion
reply
upvoteby ranger_danger16 hours ago|
parent|
prev|
[-]
And I would do chattr +i disable-algif.conf
reply
upvoteby x413212 hours ago|
parent|
prev|
[-]
are you sure containerization would be more secure? this is also a rootless podman escape. the lesson here is to not give random people shell access to your systems.
reply
upvoteby dimastopel18 hours ago|
prev|
[-]
same result on my arch machine as well.
reply