copyfail / afalg-defense

Userspace defense against CVE-2026-31431 ("Copy Fail") - an AF_ALG / authencesn page-cache corruption local privilege-escalation primitive that leaves no on-disk artefacts. Ships an LD_PRELOAD shim that blocks AF_ALG socket creation in every dynamic-linked process, plus a comprehensive read-only host posture auditor.

Designed to be a viable primary defense for the windows where the other rungs of the ladder cannot reach: the vendor kernel patch is not yet available (or you cannot reboot in that window), modprobe blacklist is a no-op because algif_aead is builtin (the RHEL default), or systemd RestrictAddressFamilies does not cover the threat surface (cron, login shells, container payloads). One .so + one ld.so.preload line, system-wide.

🔬 Read the full writeup: Copy Fail (CVE-2026-31431) on rfxn.com/research — kernel-level mechanics of the AEAD over-read, the splice-into-page-cache path that turns it into a privesc primitive, and why the userspace shim closes the practical attacker windows.

Add the repo (EL8 / EL9 / EL10)

A single copyfail.repo file works for all three: dnf expands $releasever + $basearch per host, and v1.0.1+ RPMs are GPG-signed (full gpgcheck=1 + repo_gpgcheck=1).

sudo curl -sSL https://rfxn.github.io/copyfail/copyfail.repo \
  -o /etc/yum.repos.d/copyfail.repo
sudo dnf install -y afalg-defense

After install the LD_PRELOAD shim is on disk but not yet active. Wiring /etc/ld.so.preload from a package post-install is too dangerous - one broken upgrade locks every dynamic-linked binary out of dlopen. Activation is an explicit operator action:

sudo /usr/sbin/copyfail-shim-enable    # smoke-tests, then writes /etc/ld.so.preload
sudo /usr/sbin/copyfail-shim-disable   # reverses it

Also blacklist the AF_ALG modules (where loadable)

The package also ships an equally low-barrier mitigation: a modprobe drop-in that severs algif_aead, authenc, and authencesn at the kernel level. When the kernel exposes AF_ALG as a loadable module - most stock mainline kernels do - this stacks with the shim and deserves equal weight. The shim blocks every userspace caller at libc; the blacklist removes the kernel attack surface entirely. Different mechanisms, both one-line operator actions.

# Decide whether the blacklist will be effective on this kernel.
ls /sys/module/algif_aead 2>/dev/null && echo "modular - blacklist effective" \
    || echo "builtin or absent - shim is your primary defense"
grep -E 'ALG_USERMODE|CRYPTO_USER_API' /boot/config-$(uname -r) 2>/dev/null
# =m -> modular (blacklist is primary)   =y -> builtin (shim is primary)

# If modular, drop a blacklist into /etc/modprobe.d/ and unload
# anything already resident. The CVE-2026-31431 chain is the trio at
# the bottom; the algif_* family is added for general AF_ALG hygiene.
sudo tee /etc/modprobe.d/99-no-afalg.conf >/dev/null <<'EOF'
install af_alg          /bin/false
install algif_aead      /bin/false
install algif_skcipher  /bin/false
install algif_hash      /bin/false
install algif_rng       /bin/false
install authenc         /bin/false
install authencesn      /bin/false
EOF
sudo rmmod algif_aead authenc authencesn 2>/dev/null || true

(The package also ships this file under /usr/share/doc/afalg-defense/examples/no-afalg-modprobe.conf - same content, copy that into place if you prefer the audit trail.) Where your kernel allows it, deploy both the shim and the blacklist - belt-and-suspenders coverage for the price of two sudo commands.

Verify the block

python3 -c 'import socket; socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0)'
# expect: PermissionError [Errno 1] Operation not permitted

Removal

Always disable before uninstalling so RPM does not erase the .so out from under /etc/ld.so.preload:

sudo /usr/sbin/copyfail-shim-disable
sudo dnf remove afalg-defense afalg-defense-shim afalg-defense-auditor

The package's %preun scriptlet also scrubs /etc/ld.so.preload on full erase as a safety net, but disabling first keeps the operation transparent.

Subpackages

Auditor-only is a valid install pattern for hosts that do not yet trust an LD_PRELOAD on every dynamic-linked process:

sudo dnf install -y afalg-defense-auditor

Auditor quick-start

The auditor is read-only. It writes only to mkdtemp() sentinel files, never modifies /usr/bin or /etc, and runs unprivileged (some checks degrade gracefully without root). Five categories: ENV, KERNEL, MITIGATION, HARDENING, DETECTION.

copyfail-local-check                       # human-readable, only flags non-OK
copyfail-local-check --verbose             # show passing checks too
copyfail-local-check --json                # SIEM-friendly: posture.verdict + per-check details
copyfail-local-check --skip-trigger        # no live AF_ALG probe
copyfail-local-check --skip-hardening      # skip suid/page-cache audit
copyfail-local-check --emit-remediation    # print a bash script of suggested fixes

JSON output is structured for fleet ingest. The posture.verdict field is the headline; consume that, not the human report:

{
  "schema_version": "1.1",
  "tool": "copyfail_checker",
  "cve": "CVE-2026-31431",
  "checks": [ ...per-check details... ],
  "posture": {
    "verdict": "patched | vulnerable | vulnerable_kernel_userspace_mitigated |
                kernel_likely_safe | inconclusive",
    "layers": {
      "kernel_patched":      "ok | missing | skipped | not_evaluated",
      "af_alg_unreachable":  "...",
      "modprobe_blacklist":  "...",
      "ld_preload_shim":     "...",
      "systemd_restriction": "...",
      "user_service_dropin": "...",
      "seccomp_runtime":     "...",
      "auditd_running":      "...",
      "audit_rule_af_alg":   "..."
    }
  },
  "exit_code": 0
}

Exit codes: 0 clean, 2 VULN (no userspace mitigation), 3 VULN-but-mitigated, 4 hardening recommendations only.

Direct downloads

Each release on github.com/rfxn/copyfail/releases ships per-EL binary RPMs, an SRPM, the .repo file, and the public signing key as release assets. The same files are published in the dnf tree below.

The .repo file (works on EL8/EL9/EL10):

sudo curl -sSL https://rfxn.github.io/copyfail/copyfail.repo \
  -o /etc/yum.repos.d/copyfail.repo

And the public signing key (dnf imports this automatically on first install, but you can pre-import it):

sudo curl -sSL https://rfxn.github.io/copyfail/RPM-GPG-KEY-copyfail \
  | sudo rpm --import /dev/stdin

Per-EL binary RPMs are independently compiled against each distribution's glibc (EL8: 2.28 with split libdl; EL9/EL10: 2.34+ with merged libdl) - do not cross-install across ELs.

EL8 (RHEL/Alma/Rocky/CentOS Stream 8)

EL9 (RHEL/Alma/Rocky/CentOS Stream 9)

EL10 (RHEL 10 / CentOS Stream 10 / AlmaLinux Kitten)

Signing

1.0.1 and later are signed by the Copyfail Project Signing Key:

fingerprint: 6001 1CDC EA2F F52D 975A  FDEE 6D30 F32C D5E8 0F80
uid:         Copyfail Project Signing Key <proj@rfxn.com>
key file:    /RPM-GPG-KEY-copyfail

The copyfail.repo sets both gpgcheck=1 (verifies each RPM) and repo_gpgcheck=1 (verifies repomd.xml via the detached repomd.xml.asc we publish alongside it). dnf imports the public key from gpgkey= on first use.

Verify out-of-band:

curl -sSL https://rfxn.github.io/copyfail/RPM-GPG-KEY-copyfail | gpg --import
gpg --fingerprint proj@rfxn.com
# expect: 6001 1CDC EA2F F52D 975A  FDEE 6D30 F32C D5E8 0F80
rpm --import https://rfxn.github.io/copyfail/RPM-GPG-KEY-copyfail
rpm -K /path/to/afalg-defense-1.0.1-1.el9.x86_64.rpm
# expect: digests signatures OK

Where this rung carries weight on its own

Every layer of defense for AF_ALG-class bugs has failure modes. The case for this package is that the conditions that defeat the rungs above it are not the same conditions that defeat the shim. That asymmetry is why the shim is a viable primary defense rather than just a backup.

Where the shim itself fails (static binaries, direct syscall instruction, SUID stripping) is attacker engineering territory. The other rungs fail under routine operator reality - vendors haven't shipped yet, the kernel was built with builtin crypto, the threat lives in a cron job. Deploy this rung first; layer the others as they become available.

Full writeup is in the README.

Reporting issues

Bugs, packaging problems, false positives, missing distros - please file a GitHub issue. Include the auditor's --json output if the report is about detection, and the output of uname -a + cat /etc/os-release for any runtime question.