<![CDATA[Ah, the #copyfail clickbait posts are coming.]]>Ah, the clickbait posts are coming. Here’s my contribution. On your Linux machine add

initcall_blacklist=algif_aead_init

to your kernel boot commandline (typically in grub). Reboot. You are now safe until the updated kernel packages become available. For distributions with the `grubby` command this is done as root with

# grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"

This mitigation comes courtesy of Red Hat. Our engineers keep you safe πŸ™‚

1/4

Link Preview Image
]]>https://board.circlewithadot.net/topic/ceb0cd52-f18c-4c2f-95d3-b62642a67460/ah-the-copyfail-clickbait-posts-are-coming.RSS for NodeFri, 15 May 2026 01:53:46 GMTSat, 02 May 2026 06:51:52 GMT60<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 12:07:54 GMT]]>@leah It should still work, as initcall_blacklist on init functions works regardless of it being a module or compiled in. I don't have a machine with it built as a module at hand, nor do I have the time to spin one up and check. If somebody else could help here and share the result, much appreciated.

]]>https://board.circlewithadot.net/post/https://social.wildeboer.net/users/jwildeboer/statuses/116504898758984172https://board.circlewithadot.net/post/https://social.wildeboer.net/users/jwildeboer/statuses/116504898758984172Sat, 02 May 2026 12:07:54 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 11:14:42 GMT]]>@jwildeboer I think this only works when the module is builtin (as on RHEL, but not many others).

]]>https://board.circlewithadot.net/post/https://blahaj.social/users/leah/statuses/116504689554353110https://board.circlewithadot.net/post/https://blahaj.social/users/leah/statuses/116504689554353110Sat, 02 May 2026 11:14:42 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 11:07:51 GMT]]>@caravantraveller @jwildeboer ooh, i didnt really understand much about the exploit so i thought it was a remote exploit. that's a relief for me even for my linux laptop

thanks for telling me!

]]>https://board.circlewithadot.net/post/https://woof.tech/users/Sorro/statuses/116504662602611024https://board.circlewithadot.net/post/https://woof.tech/users/Sorro/statuses/116504662602611024Sat, 02 May 2026 11:07:51 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 10:29:17 GMT]]>@sstendahl Yes, that's in the second post of my thread, with links πŸ™‚ https://social.wildeboer.net/@jwildeboer/116503831839617808

]]>https://board.circlewithadot.net/post/https://social.wildeboer.net/users/jwildeboer/statuses/116504510946098429https://board.circlewithadot.net/post/https://social.wildeboer.net/users/jwildeboer/statuses/116504510946098429Sat, 02 May 2026 10:29:17 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 10:27:50 GMT]]>@jwildeboer thanks for the post. To add, also keep on eye on which distro have patched the mitigation, Fedora patched it a week ago or so iirc, Fedora 44 doesn’t have the exploit at all. Neither does anything about running the 7.x kernel.

]]>https://board.circlewithadot.net/post/https://floss.social/users/sstendahl/statuses/116504505266890598https://board.circlewithadot.net/post/https://floss.social/users/sstendahl/statuses/116504505266890598Sat, 02 May 2026 10:27:50 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 10:26:31 GMT]]>@jwildeboer we're on Ubuntu. Yiakes then... So it needs to be checked otherwise.

]]>https://board.circlewithadot.net/post/https://fosstodon.org/users/psyhackological/statuses/116504500083395208https://board.circlewithadot.net/post/https://fosstodon.org/users/psyhackological/statuses/116504500083395208Sat, 02 May 2026 10:26:31 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 10:21:03 GMT]]>@jwildeboer @Sorro It's a bit hard to say because of the many, many flavors of Android in the wild, but it is very likely not affected for various reasons: by default, SELinux is configured to not allow alg_socket for sandboxed apps (see https://android.googlesource.com/platform/system/sepolicy/+/refs/tags/android-16.0.0_r4/private/app_neverallows.te#141), there are usually no suid binaries on Android, and algif_aead is usually not provided in the first place. Of course, a very old Android version might be affected, but in that case, you're open to various other exploits anyway...

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/hokid/statuses/116504478594555545https://board.circlewithadot.net/post/https://mastodon.social/users/hokid/statuses/116504478594555545Sat, 02 May 2026 10:21:03 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 10:19:00 GMT]]>@psyhackological Depends on your distribution. Some have it as module, some have it directly compiled into the kernel.

]]>https://board.circlewithadot.net/post/https://social.wildeboer.net/users/jwildeboer/statuses/116504470543347949https://board.circlewithadot.net/post/https://social.wildeboer.net/users/jwildeboer/statuses/116504470543347949Sat, 02 May 2026 10:19:00 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 10:13:38 GMT]]>@jwildeboer from what I read isn't this about removing kernel module? I think this keeps the system running without a reboot

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead

Don't know what will happen when it reboots though so I would stick to your plan.

]]>https://board.circlewithadot.net/post/https://fosstodon.org/users/psyhackological/statuses/116504449448117645https://board.circlewithadot.net/post/https://fosstodon.org/users/psyhackological/statuses/116504449448117645Sat, 02 May 2026 10:13:38 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 09:57:57 GMT]]>@psyhackological They'll have to do a risk calculation. It is a local user exploit, so in most cases when you freeze the current software deployment, you should be safe until the kernel patches have arrived. In general, though, your contingency plans should ALWAYS make reboots possible.

]]>https://board.circlewithadot.net/post/https://social.wildeboer.net/users/jwildeboer/statuses/116504387718801574https://board.circlewithadot.net/post/https://social.wildeboer.net/users/jwildeboer/statuses/116504387718801574Sat, 02 May 2026 09:57:57 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 09:57:50 GMT]]>@jwildeboer @flxtr Deleted it. Sorry, could not help myself and thought "Galgenhumor" could help make this serious topic a bit more relaxed.

]]>https://board.circlewithadot.net/post/https://burningboard.net/users/Larvitz/statuses/116504387310871256https://board.circlewithadot.net/post/https://burningboard.net/users/Larvitz/statuses/116504387310871256Sat, 02 May 2026 09:57:50 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 09:43:52 GMT]]>@Sorro @jwildeboer

Are there any users on your Android phone who might take advantage of ?

For single-user systems there is no problem, because it's not a remote exploit.

]]>https://board.circlewithadot.net/post/https://social.cologne/users/caravantraveller/statuses/116504332364814410https://board.circlewithadot.net/post/https://social.cologne/users/caravantraveller/statuses/116504332364814410Sat, 02 May 2026 09:43:52 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 09:41:55 GMT]]>@jwildeboer
There's a special place in hell for security researchers who obfuscate their proof-of-concept exploit code.]]>https://board.circlewithadot.net/post/https://fe.disroot.org/objects/5187ceec-03b5-452c-a814-d5b2e10c8d14https://board.circlewithadot.net/post/https://fe.disroot.org/objects/5187ceec-03b5-452c-a814-d5b2e10c8d14Sat, 02 May 2026 09:41:55 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 09:35:54 GMT]]>@echopapa @larsmb @jwildeboer alma (yay the new centos model πŸŽ‰) https://almalinux.org/blog/2026-05-01-cve-2026-31431-copy-fail/

]]>https://board.circlewithadot.net/post/https://mementomori.social/users/ikkeT/statuses/116504301025060987https://board.circlewithadot.net/post/https://mementomori.social/users/ikkeT/statuses/116504301025060987Sat, 02 May 2026 09:35:54 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 09:34:03 GMT]]>@jwildeboer what about those who cannot be downtimed to reboot?

]]>https://board.circlewithadot.net/post/https://fosstodon.org/users/psyhackological/statuses/116504293789249743https://board.circlewithadot.net/post/https://fosstodon.org/users/psyhackological/statuses/116504293789249743Sat, 02 May 2026 09:34:03 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 09:30:36 GMT]]>@Sorro I don't know. Depends if `algif_aead` is compiled into the kernel or loaded as module, if it is present at all in Android kernels. If somebody has checked, please do reply.

]]>https://board.circlewithadot.net/post/https://social.wildeboer.net/users/jwildeboer/statuses/116504280219966425https://board.circlewithadot.net/post/https://social.wildeboer.net/users/jwildeboer/statuses/116504280219966425Sat, 02 May 2026 09:30:36 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 09:29:44 GMT]]>@jwildeboer I'm sorry. You're right. Should have posted the cheap joke in my own feed.
@Larvitz

]]>https://board.circlewithadot.net/post/https://social.tchncs.de/users/flxtr/statuses/116504276773448327https://board.circlewithadot.net/post/https://social.tchncs.de/users/flxtr/statuses/116504276773448327Sat, 02 May 2026 09:29:44 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 09:27:01 GMT]]>@flxtr @Larvitz I really try hard to make this thread helpful and pragmatic, but boys gotta be boys I guess 😞

]]>https://board.circlewithadot.net/post/https://social.wildeboer.net/users/jwildeboer/statuses/116504266096822731https://board.circlewithadot.net/post/https://social.wildeboer.net/users/jwildeboer/statuses/116504266096822731Sat, 02 May 2026 09:27:01 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 09:19:41 GMT]]>@jwildeboer since android runs with the linux kernel, is android also affected?

]]>https://board.circlewithadot.net/post/https://woof.tech/users/Sorro/statuses/116504237287639580https://board.circlewithadot.net/post/https://woof.tech/users/Sorro/statuses/116504237287639580Sat, 02 May 2026 09:19:41 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 09:15:07 GMT]]>@Larvitz Edit: removed unhelpful cheap joke. I'm sorry. Will try harder to resist next time.
@jwildeboer

]]>https://board.circlewithadot.net/post/https://social.tchncs.de/users/flxtr/statuses/116504219339526686https://board.circlewithadot.net/post/https://social.tchncs.de/users/flxtr/statuses/116504219339526686Sat, 02 May 2026 09:15:07 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 08:40:19 GMT]]>@jwildeboer Nice! Btw wiki page is up: https://en.wikipedia.org/wiki/Copy_Fail πŸ™‚

]]>https://board.circlewithadot.net/post/https://chaos.social/users/tris/statuses/116504082502299531https://board.circlewithadot.net/post/https://chaos.social/users/tris/statuses/116504082502299531Sat, 02 May 2026 08:40:19 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 08:35:28 GMT]]>ADDENDUM: Now also a blog post at https://jan.wildeboer.net/2026/05/PSA-CopyFail-CVE-2026-31431/

]]>https://board.circlewithadot.net/post/https://social.wildeboer.net/users/jwildeboer/statuses/116504063426992728https://board.circlewithadot.net/post/https://social.wildeboer.net/users/jwildeboer/statuses/116504063426992728Sat, 02 May 2026 08:35:28 GMT<![CDATA[Reply to Ah, the #copyfail clickbait posts are coming. on Sat, 02 May 2026 08:25:13 GMT]]>@jwildeboer
Tbf whilst It's not great, its AT LEAST not remotely exploitable. Problematic if your workload runs untrusted stuff from external sources directly, absolutely. But likewise not quite as sky is falling as some have seemed to make it out to be.

]]>https://board.circlewithadot.net/post/https://cloudisland.nz/users/jwp/statuses/116504023079094896https://board.circlewithadot.net/post/https://cloudisland.nz/users/jwp/statuses/116504023079094896Sat, 02 May 2026 08:25:13 GMT