block-copyfail

摘要 CVE-2026-31431（“Copy Fail”）是 Linux 内核 algifaead 加密接口中的一个权限提升漏洞。攻击者利用 AFALG 套接字配合 authencesn 算法和 splice 来破坏内核页缓存中的任意文件——包括 /usr/bin/su 等 setuid 二进制文件。 本文档提供了一种零重启修复方案 ，使用 BPF LSM DaemonSet 阻止所有 AFALG AEAD 绑定——即 Copy Fail 所利用的子系统。这可以防止通过加密模板嵌套（例如 pcryptauthencesn...）进行绕过。其他 AFALG...

deny-af-alg-bpf

deny-af-alg-bpf 描述 一个 BPF LSM 程序，用于阻止 AFALG（Linux 内核加密 API）套接字的创建，并通过环形缓冲区将所有尝试记录到用户空间。 功能 挂载到 lsm/socketcreate 钩子 以 -EPERM 拒绝任何 socketAFALG, ... 调用 将结构化事件（pid、comm）发送到 BPF 环形缓冲区 用户空间守护进程读取环形缓冲区并记录到 stderr（由 systemd journal 收集） 组件 程序 denyafalg.bpf.c - 主要阻止逻辑，在 BPF（内核空间）中运行 denyafalg.user.c -...

block-copyfail

block-copyfail 概念验证 针对 CVE-2026-31431（“Copy Fail”）的运行时缓解方案——一种通过 algifaead 中的 authencesn 加密模板实现的 Linux 内核权限提升漏洞。 与模块黑名单不同，此方案无需重启 。一个 BPF LSM 程序挂接 socketbind 并阻止所有 AFALG AEAD 绑定——即 Copy Fail 所利用的子系统。这可以防止通过加密模板嵌套（例如 pcryptauthencesn...）实现的绕过。其他 AFALG 用法（hash、skcipher）不受影响。 被阻止的尝试会实时记录，包含...

copy-fail-blocker

copy-fail-blocker 针对 CVE-2026-31431（“Copy Fail”）及 Dirty Frag 的 RxRPC 变体的 BPF-LSM 缓解方案，同时适用于依赖用户态访问内核侧就地加密路径（可通过 AFALG 或 AFRXRPC 套接字族访问）的类似权限提升漏洞。 一个小型 DaemonSet 在每个节点上将一个 BPF-LSM 程序附加到 socketcreate 钩子。该程序对任何用户态 socketAFALG, ... 或 socketAFRXRPC, ... 调用返回 -EPERM，无论进程能力、命名空间或 seccomp 配置文件如何。内核内部的...

PT-2026-94969

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF LSM component where security bpf prog free is called via bpf prog put rcu, which serves as the call rcu callback for non-sleepable programs. This sequence...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-2143)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2143 advisory. In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADDADDR rtx: always decrease sk refcount CVE-2026-46158 In the Linux kernel, the following vulnerability has been...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADDADDR rtx: always decrease sk refcount CVE-2026-46158 In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADDADDR rtx: free sk if last CVE-2026-46170 In the Linux kernel, th...

CVE-2026-80669

A flaw was found in the Linux kernel. A local attacker with the ability to load BPF Berkeley Packet Filter LSM Linux Security Module programs could exploit a vulnerability in the xfrmdecodesession hook. This could lead to a system panic, resulting in a Denial of Service DoS...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2071)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2071 advisory. In the Linux kernel, the following vulnerability has been resolved: afunix: Drop all SCM attributes for SOCKMAP. CVE-2026-53005 In the Linux kernel, the following vulnerability has been...

Important: kernel6.18

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: afunix: Drop all SCM attributes for SOCKMAP. CVE-2026-53005 In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing locking around retry adding new subreqs CVE-2026-64068 In the Linu...

SUSE CVE-2026-80669

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

CVE-2026-80669

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

CVE-2026-80669

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

UBUNTU-CVE-2026-80669

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

CVE-2026-80669 bpf: Disable xfrm_decode_session hook attachment

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

CVE-2026-80669

This Linux kernel vulnerability affects the interaction between BPF LSM programs and the xfrm_decode_session() hook. BPF LSM programs can attach to this hook, which may return an error. However, security_skb_classify_flow() invokes the hook from a void path and triggers a BUG_ON() if an error is ...

EUVD-2026-67545

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

CVE-2026-80669 bpf: Disable xfrm_decode_session hook attachment

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

CVE-2026-80669: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

PT-2026-82969

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description BPF LSM programs can attach to the xfrm decode session hook. Because security skb classify flow calls this hook from a void path, any error returned by the hook triggers a BUG ON...