Is my RHEL system vulnerable to the Copy Fail (CVE-2026-31431) flaw?
Environment
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux 10
Issue
- Is my RHEL system vulnerable to the Copy Fail (CVE-2026-31431) flaw?
Resolution
Important: The information in this Solution is provided for convenience. Please refer to our CVE page and Security Bulletin for the latest information.
CVE page & Security Bulletin:
- CVE-2026-31431
- This content is not included.RHSB-2026-02: Cryptographic Subsystem Privilege Escalation in Linux Kernel (CVE-2026-31431)
Instruction to update
- Patched version of kernel is now available:
| RHEL Version | RHSA ID | Patched Kernel Version |
|---|---|---|
| RHEL 7 and earlier | N/A | Not affected, Vulnerable code not present |
| RHEL 8.8 E4S | RHSA-2026:13681 | kernel-4.18.0-477.139.1.el8_8 |
| RHEL 8 | RHSA-2026:13577 | kernel-4.18.0-553.123.1.el8_10 |
| RHEL 9.2 E4S | RHSA-2026:13734 | kernel-5.14.0-284.169.1.el9_2 |
| RHEL 9.4 EUS | RHSA-2026:13932 | kernel-5.14.0-427.124.1.el9_4 |
| RHEL 9.6 EUS | RHSA-2026:14339 | kernel-5.14.0-570.112.1.el9_6 |
| RHEL 9 | This content is not included.RHSA-2026:19225 | kernel-5.14.0-687.5.3.el9_8 |
| RHEL 10.0 EUS | RHSA-2026:13887 | kernel-6.12.0-55.71.1.el10_0 |
| RHEL 10 | This content is not included.RHSA-2026:19074 | kernel-6.12.0-211.7.3.el10_2 |
-
Apply the latest kernel security updates:
# dnf update kernel -
Revert the mitigation if it was applied
See below "Reverting the Mitigation".
-
Reboot the system
# reboot
- Live kernel patches (kpatch) for selected kernels are also available for RHEL 9 ( RHSA-2026:15978) and RHEL 8 (RHSA-2026:15976)
See Also:
- How do I install fixes for a given vulnerability?
- How to install the latest kernel version on RHEL 8/9/10?
- How to install a kernel on an offline RHEL 8/9/10 system?
- Why does the system require a reboot to use the newly installed kernel?
Mitigation (Legacy)
This section is retained for legacy reason.
We recommend you install the patched kernel instead since this mitigation might have a performance impact for functionality that uses kernel cryptographic functions.
If you have installed the patched kernel, we recommend you reverted the Mitigation.
Mitigation mentioned in CVE-2026-31431 is to add a boot argument in boot loader. See steps below:
-
Run below command to append the option to kernel command line
# grubby --update-kernel=ALL --args='initcall_blacklist=algif_aead_init' -
On IBM Z only, execute zipl
# zipl -
Reboot the system
# reboot -
Verification: once rebooted, verify the parameter
# cat /proc/cmdline | grep initcall_blacklist BOOT_IMAGE=(hd0,gpt2)/vmlinuz<...> initcall_blacklist=algif_aead_init
Reverting the Mitigation
Once the RHSA is available and installed to reverse the mitigation see steps below:
-
Run below command to remove the option to kernel command line
# grubby --update-kernel=ALL --remove-args='initcall_blacklist=algif_aead_init' -
On IBM Z only, execute zipl
# zipl -
Reboot the system
# reboot -
Verification: once rebooted, verify the parameter has been removed
# cat /proc/cmdline | grep initcall_blacklist <... no output ...>
Related solutions
The below solutions are detailed for each environment
Root Cause
A flaw that allows the kernel to accidentally overwrite its protected memory with temporary data while processing certain encryption tasks. The current mitigation requires reboot to get affected.
See Also:
Diagnostic Steps
-
Check the used kernel version, if the version match the the Patched kernel version for the RHEL release or is newer the system is not affected.
uname -r
This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.