Mitigating CVE-2026-31431 aka "Copy Fail" on DietPi

MichaIng · 4 May 2026 20:21

Please read this info about mitigating CVE-2026-31431 aka “Copy Fail” on DietPi:

github.com/MichaIng/DietPi

Mitigating CVE-2026-31431 aka "Copy Fail" on DietPi

opened 04:12PM - 01 May 26 UTC

AdamF100001

Solution available

Kernel related

Security

Package update

## ADMIN EDIT To mitigate the recently disclosed Linux kernel vulnerability [CVE…-2026-31431 aka "Copy Fail"](https://copy.fail/) on DietPi, please upgrade the kernel packages on your systems, or prevent the affected kernel module from being loaded. Debian has updated their kernel packages already, hence on x86_64 systems, just upgrade all packages via APT: ```sh sudo apt update sudo apt upgrade ``` On systems with our kernel packages built with the Armbian build system, you may see something like "package has been held back". The reason is that we merged the `linux-image-*` and `linux-dtb-*` packages, which prevents APT from performing the upgrade without confirmation. In this case, do a full-upgrade, which will show `linux-image-*` being upgraded, and `linux-dtb-*` removed, which is intended: ```sh sudo apt full-upgrade ``` **Don't forget to `reboot` afterwards, to load the new kernel.** **Raspberry Pi** Ltd has not pushed a kernel update to their APT repository yet. But they [are aware of it](https://forums.raspberrypi.com/viewtopic.php?t=397946). Also, some individual SBCs have a frozen kernel version, notably the **Odroid C1**, **Star64**, **VisionFive 2**, and **Rockchip SBCs** with `linux-image-vendor-rk35xx` kernel. To know whether your kernel is affected or not, compare the version `uname -r` with the range of affected versions listed here: https://nvd.nist.gov/vuln/detail/CVE-2026-31431#vulnConfigurationsArea In this case, please mitigate the issue by preventing the affected kernel module from being loaded: ```sh echo -e 'blacklist algif_aead\ninstall algif_aead /bin/false' | sudo tee /etc/modprobe.d/disable-algif.conf sudo modprobe -r algif_aead sudo update-initramfs -u ``` The "blacklist" prevents the module from being loaded by the kernel device tree, udev etc, and prevents it from being added to the initramfs image (hence the `update-initramfs` afterwards). The `install algif_aead /bin/false` prevents it as well from being loaded explicitly, so `modprobe algif_aead` and similar will throw an error instead. I don't know which software is making use of that module, I do not see it being loaded on any of my Linux systems. But please report if you see issues after this, that would be good to know. _________________ Hi All, Just a quick question when will Copy Fail CVE-2026-31431 be patched in DietPi? Thanks