security - Re: CVE-2026-31431: CopyFail: linux local privilege scalation

Products

Openwall GNU/*/Linux   server OS Linux Kernel Runtime Guard John the Ripper   password cracker

Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS

Wordlists   for password cracking passwdqc   policy enforcement

Free & Open Source for Unix Pro for Windows (Active Directory)

yescrypt   KDF & password hashing yespower   Proof-of-Work (PoW) crypt_blowfish   password hashing phpass   ditto in PHP tcb   better password shadowing Pluggable Authentication Modules scanlogd   port scan detector popa3d   tiny POP3 daemon blists   web interface to mailing lists msulogin   single user mode login php_mt_seed   mt_rand() cracker

Services Publications

Articles Presentations

Resources

Mailing lists Community wiki Source code repositories (GitHub) File archive & mirrors How to verify digital signatures OVE IDs

What's new

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list] Message-ID: <87se8dgicq.fsf@gentoo.org> Date: Thu, 30 Apr 2026 05:52:37 +0100 From: Sam James <sam@...too.org> To: oss-security@...ts.openwall.com Cc: Jan Schaumann <jschauma@...meister.org> Subject: Re: CVE-2026-31431: CopyFail: linux local privilege scalation

Eddie Chapman <eddie@...k.net> writes:

> On 29/04/2026 21:23, Jan Schaumann wrote: >> Affected and fixed versions >> =========================== >>

Issue introduced in 4.14 with commit >> 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 and fixed in >> 6.18.22 with commit >> fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8 >> Issue introduced in 4.14 with commit >> 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 and fixed in >> 6.19.12 with commit >> ce42ee423e58dffa5ec03524054c9d8bfd4f6237 >> Issue introduced in 4.14 with commit >> 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 and fixed in >> 7.0 with commit >> a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5 >> https://git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8 >> https://git.kernel.org/stable/c/ce42ee423e58dffa5ec03524054c9d8bfd4f6237 >> https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5 > > So this is one of the worst make-me-root vulnerabilities in the kernel > in recent times. I see that on the 11th of April 6.19.12 & 6.18.22 > were released with the fix backported.

> > Longterm 6.12, 6.6, 6.1, 5.15, 5.10 have not received the fix and I > don't see anything in the upstream stable queues yet as I write. My > guess is backporting that far back is not as straightforward. As this > was introduced in 2017 all those older kernels are affected, right? Or > am I missing something?

It does not apply cleanly, no. Attached is the workaround we're going to use. I'm not an expert on IPSec but I think this is the lesser evil.

I attempted a backport but ran into a few API changes and wasn't confident enough to muck around with it, especially for something to deploy immediately.

> [...] > > What went wrong, has the embargo been broken early today? Not looking > to point any fingers, those who make things happen in our communities > work dam hard and deserve respect and support, especially with the > extra burden of AI slop now.

Note that for Linux kernel vulnerabilities, unless the reporter chooses to bring it to the linux-distros ML, there is no heads-up to distributions.

It did not happen here.

> > Eddie

sam

View attachment "0001-crypto-disable-authencesn-module-for-CVE-2026-31431.patch" of type "text/x-patch" (1543 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (419 bytes)

Powered by blists - more mailing lists

Please check out the

Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.