alg_check

⚠️ 重要免責事項: 構造的ハードニングのリスク このツールは、カーネルモジュールを物理的にリネームし、メモリからパージすることで CVE-2026-31431 を緩和する 構造的ブロッキング を実装しています。使用前に、以下のアーキテクチャ上のリスクを認識してください: カーネル更新による変動性 : ハードニングの効果は 一時的 です。カーネル更新により、新しい /lib/modules/ ディレクトリ配下に脆弱なモジュールが新規展開され、以前の妨害措置は無効になります。 機能的な副作用 :...

CVE-2026-31431

📌 CVE-2026-31431 – AEAD暗号ソケットの誤用による権限昇格 🧠 概要 CVE-2026-31431は、AFALG（カーネル暗号API） インターフェースを悪用するLinuxの権限昇格の脆弱性です。AEAD（Associated Data付き認証暗号）ソケットとの悪意のある相互作用を細工することで、攻撃者は権限を昇格させ、rootとしてコードを実行できます。 この脆弱性は、暗号ソケット操作の不適切な処理を悪用し、制御されたメモリ操作と最終的な権限昇格を可能にします。 ⚠️ 影響 ローカル権限昇格 rootシェルへのアクセス（/usr/bin/su）...

Paranoid-Copy-Fail-CVE-2026-31431

================================ Paranoid AFALG ハードニングスクリプト ================================ すべてのユーザー空間カーネル暗号インターフェース（AFALG + algif モジュール）をブロックします CVE-2026-31431 を緩和し、将来の攻撃対象領域を削減します 通常のシステム（SSH、TLS、LUKS、WireGuard）では安全です AFALG ソケットを直接使用する稀なアプリのみが影響を受けます ================================...

mks-copy-fail-mitigation

Copy Fail 완화 DaemonSets MKS 클러스터의 모든 worker 노드에서 Copy Fail 계열 취약점을 수정하기 위한 DaemonSet입니다. 목차 CVE-2026-31431 Copy Fail CVE-2026-43284, CVE-2026-43500, CopyFail2 Dirty Flag CVE-2026-31431 Copy Fail 취약점 설명 CVE ID: CVE-2026-31431 CVE Link: https://nvd.nist.gov/vuln/detail/CVE-2026-31431 CVSS v.3.1에 따른...

libkcapi security update

An update is available for libkcapi. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list libkcapi allows user-space to access the Linux kernel crypto API. This libra...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: crypto: algifaead – Fixed the issue with the check for the minimum RX size during decryption. The check for the minimum receive buffer size did not take the tag size into account during decryption. This issue has been fixed by...

CVE-2026-80831

In the Linux kernel, the following vulnerability has been resolved: crypto: mxs-dcp - fix source scatterlist length access mxsdcpaesblockcrypt uses sgdmalen without mapping the source scatterlist with dmamapsg first. Therefore, sgdmalen is invalid and could return zero or a stale DMA length,...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104542)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104542 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: algifskcipher - force synchronous processing on trees without ctx-state The AIO/async pat...

OESA-2026-3440 libkcapi security update

The Linux kernel exports a Netlink interface of type AFALG to allow user space to utilize the kernel crypto API. libkcapi uses this Netlink interface and exports easy to use APIs so that a developer does not need to consider the low-level Netlink interface handling. The library does not implement...

CVE-2026-71225 affecting package libkcapi for versions less than 1.5.1-1

CVE-2026-71225 affecting package libkcapi for versions less than 1.5.1-1. An upgraded version of the package is available that resolves this issue...

Linux Distros Unpatched Vulnerability : CVE-2026-74403

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: ccp - Check for page allocation failure correctly in TIO Sashiko notes: if snpallocfirmwarepages returns NULL under memory pressure, is it safe to pass ...

The vulnerability of the parse_longname() function in the fs/ceph/crypto.c module of the distributed file system Ceph’s kernel support for Linux operating systems allows a hacker to cause a service failure.

The vulnerability of the parselongname function in the fs/ceph/crypto.c module, which is part of the Ceph distributed file system support for Linux operating systems, relates to the pointer dereferencing. Exploiting this vulnerability could allow a malicious actor to cause service failures remote...

CVE-2026-74566

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring key-chunk byte order agree with keyringdiffobjects keyringgetkeychunk loads description bytes into the index chunk low address first, while keyringdiffobjects numbers the first differing bit from the low end an...

CVE-2026-74280 crypto: marvell/octeontx - fix DMA cleanup using wrong loop index

In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The sgcleanup path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

PT-2026-72339

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tpm buf append salt function within drivers/char/tpm/tpm2-sessions.c. The function calls crypto kpp generate public key and crypto kpp compute shared secret withou...

Linux Distros Unpatched Vulnerability : CVE-2026-68147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fscrypt: Avoid dynamic allocation in fscryptgetdevices When a blkcryptokey starts being used or is evicted, fs/crypto/ calls fscryptgetdevices to get the...

CVE-2026-71226

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers. Mitigation To mitigate this issue, applications should avoid initializing libkcapi handle...

SUSE CVE-2026-64439

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5aeadencrypt, krb5aeaddecrypt in rfc3961simplified.c and rfc8009encrypt, rfc8009decrypt in rfc8009aes2.c set a NULL completion callback and treat any negative retur...

CVE-2026-64439 crypto: krb5 - filter out async aead implementations at alloc

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5aeadencrypt, krb5aeaddecrypt in rfc3961simplified.c and rfc8009encrypt, rfc8009decrypt in rfc8009aes2.c set a NULL completion callback and treat any negative retur...

PT-2026-64660

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the Linux kernel's crypto krb5 implementation. The functions krb5 aead encrypt, krb5 aead decrypt, rfc8009 encrypt, and rfc8009 decrypt set a NULL...