[cherry-pick v20260413] fix: mitigate CVE-2026-31431 (Copy Fail) algif_aead LPE by djsly · Pull Request #8443 · Azure/AgentBaker

djsly · 2026-05-01T01:19:34Z

Cherry-pick of CVE-2026-31431 mitigation from PR #8437 to release branch official/v20260413.

Changes

modprobe-CIS.conf: Block algif_aead module (install + blacklist)
cse_main.sh: Runtime mitigation for existing VHDs (Ubuntu + AzureLinux)

CVE Details

CVE-2026-31431 — Local privilege escalation (CVSS 7.8 HIGH) via algif_aead kernel module
No kernel fix available yet — mitigation disables the module
AB#37761004

Disable algif_aead kernel module to mitigate local privilege escalation vulnerability (CVSS 7.8 HIGH) until kernel fix is available (~21 days). VHD build: Add 'install algif_aead /bin/false' to modprobe-CIS.conf CSE provisioning: Apply runtime mitigation on existing VHDs (creates modprobe config + rmmod if module is loaded) Per Canonical advisory: https://ubuntu.com/blog/copy-fail-vulnerability-fixes-available AB#37761004 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The algif_aead vulnerability affects all Linux kernels >=4.15, not just Ubuntu. Extend CSE runtime mitigation to also cover AzureLinux/Mariner. VHD build was already covered since modprobe-CIS.conf is shared across all OS builds (Ubuntu, AzureLinux, ACL, Flatcar). Ubuntu 20.04 FIPS is also covered (same shared config + CSE path). AB#37761004 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Add 'blacklist algif_aead' alongside install rule for CIS consistency - Log success/failure of rmmod with actionable reboot guidance - Only attempt rmmod when module is actually loaded AB#37761004 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-05-01T01:21:00Z

Changes cached containers or packages on windows VHDs

Please get a Windows SIG member to approve.

The following dif file shows any additions or deletions from what will be cached on windows VHDs organised by VHD type.

Additions are new things cached.
Deletions are things no longer cached.

diff --git a/vhd_files/2022-containerd-gen2.txt b/vhd_files/2022-containerd-gen2.txt
index a67cc2d..cfac7fb 100644
--- a/vhd_files/2022-containerd-gen2.txt
+++ b/vhd_files/2022-containerd-gen2.txt
@@ -4 +4 @@ c:\akse-cache\: https://packages.aks.azure.com/ccgakvplugin/v1.1.5/binaries/wind
-c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.1/windows-amd64.zip
+c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.0.2/windows-amd64.zip
@@ -28 +28 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.12/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.10/windowszip/v1.33.10-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.7/windowszip/v1.33.7-1int.zip
@@ -103,3 +103,3 @@ mcr.microsoft.com/containernetworking/azure-cni:v1.5.50
-mcr.microsoft.com/containernetworking/azure-cni:v1.6.43-0
-mcr.microsoft.com/containernetworking/azure-cni:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cni:v1.8.6-0
+mcr.microsoft.com/containernetworking/azure-cni:v1.6.35-0
+mcr.microsoft.com/containernetworking/azure-cni:v1.7.15-0
+mcr.microsoft.com/containernetworking/azure-cni:v1.8.1-0
@@ -107,3 +107,3 @@ mcr.microsoft.com/containernetworking/azure-cns:v1.5.50
-mcr.microsoft.com/containernetworking/azure-cns:v1.6.43-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.8.6-0
+mcr.microsoft.com/containernetworking/azure-cns:v1.6.35-0
+mcr.microsoft.com/containernetworking/azure-cns:v1.7.15-0
+mcr.microsoft.com/containernetworking/azure-cns:v1.8.1-0
@@ -118,5 +118,5 @@ mcr.microsoft.com/oss/v2/azure/secrets-store/provider-azure:v1.7.2
-mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.33.9-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.34.3-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.33.9-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.5-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.2-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.33.8-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.34.2-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.33.8-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.4-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.1-windows-hp
@@ -131,2 +130,0 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.11-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.16-windows-hpc-1
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.11-windows-hpc-1
@@ -135 +132,0 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.3-windows-hpc
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.8-windows-hpc-1
@@ -137 +133,0 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.1-windows-hpc
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.3-windows-hpc-1
@@ -139,0 +136 @@ mcr.microsoft.com/windows/nanoserver:ltsc2022
+mcr.microsoft.com/windows/servercore:10.0.20348.4773
@@ -141 +137,0 @@ mcr.microsoft.com/windows/servercore:10.0.20348.4893
-mcr.microsoft.com/windows/servercore:10.0.20348.5020
@@ -147 +143 @@ Windows 2022-containerd-gen2 base image sku: 2022-datacenter-core-smalldisk-g2
-Windows 2022-containerd-gen2 base version: 20348.5020.260413
+Windows 2022-containerd-gen2 base version: 20348.4893.260303
diff --git a/vhd_files/2022-containerd.txt b/vhd_files/2022-containerd.txt
index abc0646..f57c982 100644
--- a/vhd_files/2022-containerd.txt
+++ b/vhd_files/2022-containerd.txt
@@ -4 +4 @@ c:\akse-cache\: https://packages.aks.azure.com/ccgakvplugin/v1.1.5/binaries/wind
-c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.1/windows-amd64.zip
+c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.0.2/windows-amd64.zip
@@ -28 +28 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.12/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.10/windowszip/v1.33.10-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.7/windowszip/v1.33.7-1int.zip
@@ -103,3 +103,3 @@ mcr.microsoft.com/containernetworking/azure-cni:v1.5.50
-mcr.microsoft.com/containernetworking/azure-cni:v1.6.43-0
-mcr.microsoft.com/containernetworking/azure-cni:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cni:v1.8.6-0
+mcr.microsoft.com/containernetworking/azure-cni:v1.6.35-0
+mcr.microsoft.com/containernetworking/azure-cni:v1.7.15-0
+mcr.microsoft.com/containernetworking/azure-cni:v1.8.1-0
@@ -107,3 +107,3 @@ mcr.microsoft.com/containernetworking/azure-cns:v1.5.50
-mcr.microsoft.com/containernetworking/azure-cns:v1.6.43-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.8.6-0
+mcr.microsoft.com/containernetworking/azure-cns:v1.6.35-0
+mcr.microsoft.com/containernetworking/azure-cns:v1.7.15-0
+mcr.microsoft.com/containernetworking/azure-cns:v1.8.1-0
@@ -118,5 +118,5 @@ mcr.microsoft.com/oss/v2/azure/secrets-store/provider-azure:v1.7.2
-mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.33.9-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.34.3-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.33.9-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.5-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.2-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.33.8-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.34.2-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.33.8-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.4-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.1-windows-hp
@@ -131,2 +130,0 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.11-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.16-windows-hpc-1
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.11-windows-hpc-1
@@ -135 +132,0 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.3-windows-hpc
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.8-windows-hpc-1
@@ -137 +133,0 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.1-windows-hpc
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.3-windows-hpc-1
@@ -139,0 +136 @@ mcr.microsoft.com/windows/nanoserver:ltsc2022
+mcr.microsoft.com/windows/servercore:10.0.20348.4773
@@ -141 +137,0 @@ mcr.microsoft.com/windows/servercore:10.0.20348.4893
-mcr.microsoft.com/windows/servercore:10.0.20348.5020
@@ -147 +143 @@ Windows 2022-containerd base image sku: 2022-Datacenter-Core-smalldisk
-Windows 2022-containerd base version: 20348.5020.260413
+Windows 2022-containerd base version: 20348.4893.260303
diff --git a/vhd_files/2025-gen2.txt b/vhd_files/2025-gen2.txt
index 7c9a9ca..a1b2b36 100644
--- a/vhd_files/2025-gen2.txt
+++ b/vhd_files/2025-gen2.txt
@@ -4 +4 @@ c:\akse-cache\: https://packages.aks.azure.com/ccgakvplugin/v1.1.5/binaries/wind
-c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.1/windows-amd64.zip
+c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.0.2/windows-amd64.zip
@@ -26 +26 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.12/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.10/windowszip/v1.33.10-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.7/windowszip/v1.33.7-1int.zip
@@ -34,3 +34,3 @@ mcr.microsoft.com/containernetworking/azure-cni:v1.5.50
-mcr.microsoft.com/containernetworking/azure-cni:v1.6.43-0
-mcr.microsoft.com/containernetworking/azure-cni:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cni:v1.8.6-0
+mcr.microsoft.com/containernetworking/azure-cni:v1.6.35-0
+mcr.microsoft.com/containernetworking/azure-cni:v1.7.15-0
+mcr.microsoft.com/containernetworking/azure-cni:v1.8.1-0
@@ -38,3 +38,3 @@ mcr.microsoft.com/containernetworking/azure-cns:v1.5.50
-mcr.microsoft.com/containernetworking/azure-cns:v1.6.43-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.8.6-0
+mcr.microsoft.com/containernetworking/azure-cns:v1.6.35-0
+mcr.microsoft.com/containernetworking/azure-cns:v1.7.15-0
+mcr.microsoft.com/containernetworking/azure-cns:v1.8.1-0
@@ -49,5 +49,5 @@ mcr.microsoft.com/oss/v2/azure/secrets-store/provider-azure:v1.7.2
-mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.33.9-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.34.3-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.33.9-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.5-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.2-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.33.8-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.34.2-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.33.8-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.4-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.1-windows-hp
@@ -62,2 +61,0 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.11-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.16-windows-hpc-1
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.11-windows-hpc-1
@@ -66 +63,0 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.3-windows-hpc
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.8-windows-hpc-1
@@ -68 +64,0 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.1-windows-hpc
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.3-windows-hpc-1
@@ -71,0 +68 @@ mcr.microsoft.com/windows/nanoserver:ltsc2025
+mcr.microsoft.com/windows/servercore:10.0.20348.4773
@@ -73 +70 @@ mcr.microsoft.com/windows/servercore:10.0.20348.4893
-mcr.microsoft.com/windows/servercore:10.0.20348.5020
+mcr.microsoft.com/windows/servercore:10.0.26100.32370
@@ -75 +71,0 @@ mcr.microsoft.com/windows/servercore:10.0.26100.32522
-mcr.microsoft.com/windows/servercore:10.0.26100.32690
@@ -80 +76 @@ Windows 2025-gen2 base image sku: 2025-datacenter-core-smalldisk-g2
-Windows 2025-gen2 base version: 26100.32690.260413
+Windows 2025-gen2 base version: 26100.32522.260306
diff --git a/vhd_files/2025.txt b/vhd_files/2025.txt
index 9a53a2a..7e331bb 100644
--- a/vhd_files/2025.txt
+++ b/vhd_files/2025.txt
@@ -4 +4 @@ c:\akse-cache\: https://packages.aks.azure.com/ccgakvplugin/v1.1.5/binaries/wind
-c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.1/windows-amd64.zip
+c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.0.2/windows-amd64.zip
@@ -26 +26 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.12/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.10/windowszip/v1.33.10-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.7/windowszip/v1.33.7-1int.zip
@@ -34,3 +34,3 @@ mcr.microsoft.com/containernetworking/azure-cni:v1.5.50
-mcr.microsoft.com/containernetworking/azure-cni:v1.6.43-0
-mcr.microsoft.com/containernetworking/azure-cni:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cni:v1.8.6-0
+mcr.microsoft.com/containernetworking/azure-cni:v1.6.35-0
+mcr.microsoft.com/containernetworking/azure-cni:v1.7.15-0
+mcr.microsoft.com/containernetworking/azure-cni:v1.8.1-0
@@ -38,3 +38,3 @@ mcr.microsoft.com/containernetworking/azure-cns:v1.5.50
-mcr.microsoft.com/containernetworking/azure-cns:v1.6.43-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.8.6-0
+mcr.microsoft.com/containernetworking/azure-cns:v1.6.35-0
+mcr.microsoft.com/containernetworking/azure-cns:v1.7.15-0
+mcr.microsoft.com/containernetworking/azure-cns:v1.8.1-0
@@ -49,5 +49,5 @@ mcr.microsoft.com/oss/v2/azure/secrets-store/provider-azure:v1.7.2
-mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.33.9-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.34.3-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.33.9-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.5-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.2-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.33.8-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.34.2-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.33.8-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.4-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.1-windows-hp
@@ -62,2 +61,0 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.11-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.16-windows-hpc-1
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.11-windows-hpc-1
@@ -66 +63,0 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.3-windows-hpc
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.8-windows-hpc-1
@@ -68 +64,0 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.1-windows-hpc
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.3-windows-hpc-1
@@ -71,0 +68 @@ mcr.microsoft.com/windows/nanoserver:ltsc2025
+mcr.microsoft.com/windows/servercore:10.0.20348.4773
@@ -73 +70 @@ mcr.microsoft.com/windows/servercore:10.0.20348.4893
-mcr.microsoft.com/windows/servercore:10.0.20348.5020
+mcr.microsoft.com/windows/servercore:10.0.26100.32370
@@ -75 +71,0 @@ mcr.microsoft.com/windows/servercore:10.0.26100.32522
-mcr.microsoft.com/windows/servercore:10.0.26100.32690
@@ -80 +76 @@ Windows 2025 base image sku: 2025-datacenter-core-smalldisk
-Windows 2025 base version: 26100.32690.260413
+Windows 2025 base version: 26100.32522.260306
diff --git a/vhd_files/23H2-gen2.txt b/vhd_files/23H2-gen2.txt
index baa32a3..48dbfb0 100644
--- a/vhd_files/23H2-gen2.txt
+++ b/vhd_files/23H2-gen2.txt
@@ -4 +4 @@ c:\akse-cache\: https://packages.aks.azure.com/ccgakvplugin/v1.1.5/binaries/wind
-c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.1/windows-amd64.zip
+c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.0.2/windows-amd64.zip
@@ -27 +27 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.12/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.10/windowszip/v1.33.10-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.7/windowszip/v1.33.7-1int.zip
@@ -53,3 +53,3 @@ mcr.microsoft.com/containernetworking/azure-cni:v1.5.50
-mcr.microsoft.com/containernetworking/azure-cni:v1.6.43-0
-mcr.microsoft.com/containernetworking/azure-cni:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cni:v1.8.6-0
+mcr.microsoft.com/containernetworking/azure-cni:v1.6.35-0
+mcr.microsoft.com/containernetworking/azure-cni:v1.7.15-0
+mcr.microsoft.com/containernetworking/azure-cni:v1.8.1-0
@@ -57,3 +57,3 @@ mcr.microsoft.com/containernetworking/azure-cns:v1.5.50
-mcr.microsoft.com/containernetworking/azure-cns:v1.6.43-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.8.6-0
+mcr.microsoft.com/containernetworking/azure-cns:v1.6.35-0
+mcr.microsoft.com/containernetworking/azure-cns:v1.7.15-0
+mcr.microsoft.com/containernetworking/azure-cns:v1.8.1-0
@@ -68,5 +68,5 @@ mcr.microsoft.com/oss/v2/azure/secrets-store/provider-azure:v1.7.2
-mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.33.9-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.34.3-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.33.9-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.5-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.2-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.33.8-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.34.2-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.33.8-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.4-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.1-windows-hp
@@ -81,2 +80,0 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.11-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.16-windows-hpc-1
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.11-windows-hpc-1
@@ -85 +82,0 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.3-windows-hpc
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.8-windows-hpc-1
@@ -87 +83,0 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.1-windows-hpc
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.3-windows-hpc-1
@@ -89,0 +86 @@ mcr.microsoft.com/windows/nanoserver:ltsc2022
+mcr.microsoft.com/windows/servercore:10.0.20348.4773
@@ -91 +87,0 @@ mcr.microsoft.com/windows/servercore:10.0.20348.4893
-mcr.microsoft.com/windows/servercore:10.0.20348.5020
@@ -95 +91 @@ Windows 23H2-gen2 base image sku: 23h2-datacenter-core-g2
-Windows 23H2-gen2 base version: 25398.2274.260411
+Windows 23H2-gen2 base version: 25398.2207.260303
diff --git a/vhd_files/23H2.txt b/vhd_files/23H2.txt
index b30587b..6b1ed52 100644
--- a/vhd_files/23H2.txt
+++ b/vhd_files/23H2.txt
@@ -4 +4 @@ c:\akse-cache\: https://packages.aks.azure.com/ccgakvplugin/v1.1.5/binaries/wind
-c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.1/windows-amd64.zip
+c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.0.2/windows-amd64.zip
@@ -27 +27 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.12/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.10/windowszip/v1.33.10-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.7/windowszip/v1.33.7-1int.zip
@@ -53,3 +53,3 @@ mcr.microsoft.com/containernetworking/azure-cni:v1.5.50
-mcr.microsoft.com/containernetworking/azure-cni:v1.6.43-0
-mcr.microsoft.com/containernetworking/azure-cni:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cni:v1.8.6-0
+mcr.microsoft.com/containernetworking/azure-cni:v1.6.35-0
+mcr.microsoft.com/containernetworking/azure-cni:v1.7.15-0
+mcr.microsoft.com/containernetworking/azure-cni:v1.8.1-0
@@ -57,3 +57,3 @@ mcr.microsoft.com/containernetworking/azure-cns:v1.5.50
-mcr.microsoft.com/containernetworking/azure-cns:v1.6.43-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.8.6-0
+mcr.microsoft.com/containernetworking/azure-cns:v1.6.35-0
+mcr.microsoft.com/containernetworking/azure-cns:v1.7.15-0
+mcr.microsoft.com/containernetworking/azure-cns:v1.8.1-0
@@ -68,5 +68,5 @@ mcr.microsoft.com/oss/v2/azure/secrets-store/provider-azure:v1.7.2
-mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.33.9-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.34.3-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.33.9-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.5-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.2-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.33.8-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azuredisk-csi:v1.34.2-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.33.8-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.34.4-windows-hp
+mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.1-windows-hp
@@ -81,2 +80,0 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.11-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.32.16-windows-hpc-1
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.11-windows-hpc-1
@@ -85 +82,0 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.3-windows-hpc
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.8-windows-hpc-1
@@ -87 +83,0 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.1-windows-hpc
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.3-windows-hpc-1
@@ -89,0 +86 @@ mcr.microsoft.com/windows/nanoserver:ltsc2022
+mcr.microsoft.com/windows/servercore:10.0.20348.4773
@@ -91 +87,0 @@ mcr.microsoft.com/windows/servercore:10.0.20348.4893
-mcr.microsoft.com/windows/servercore:10.0.20348.5020
@@ -95 +91 @@ Windows 23H2 base image sku: 23h2-datacenter-core
-Windows 23H2 base version: 25398.2274.260411
+Windows 23H2 base version: 25398.2207.260303

Copilot

Pull request overview

Cherry-picks the CVE-2026-31431 mitigation into official/v20260413 by disabling the vulnerable algif_aead kernel module both for newly built VHDs (via modprobe CIS config) and at provisioning time for existing VHDs (via CSE).

Changes:

Add install + blacklist rules for algif_aead in the shared modprobe-CIS.conf.
Add a CSE runtime mitigation in cse_main.sh that writes a disablement config (if missing) and attempts to unload algif_aead when already loaded.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
parts/linux/cloud-init/artifacts/modprobe-CIS.conf	Adds CIS modprobe rules to prevent `algif_aead` from loading on new VHDs.
parts/linux/cloud-init/artifacts/cse_main.sh	Adds runtime mitigation for nodes provisioned from existing VHDs by writing a modprobe.d rule and attempting `rmmod`.

Copilot · 2026-05-01T01:22:40Z

+        if ! grep -qs "algif_aead" /etc/modprobe.d/*.conf 2>/dev/null; then
+            printf "install algif_aead /bin/false\nblacklist algif_aead\n" > /etc/modprobe.d/disable-algif_aead.conf


The guard grep -qs "algif_aead" /etc/modprobe.d/*.conf can return a false positive (e.g., a comment/alias mentioning algif_aead) and then skip writing the actual install ... /bin/false + blacklist rules, leaving the node unmitigated. Consider checking specifically for an install algif_aead and/or blacklist algif_aead directive (or just ensure /etc/modprobe.d/disable-algif_aead.conf exists with the expected contents, without relying on a broad grep across all conf files).

Suggested change

if ! grep -qs "algif_aead" /etc/modprobe.d/*.conf 2>/dev/null; then

printf "install algif_aead /bin/false\nblacklist algif_aead\n" > /etc/modprobe.d/disable-algif_aead.conf

if [ ! -f /etc/modprobe.d/disable-algif_aead.conf ] || \

! grep -Fqx 'install algif_aead /bin/false' /etc/modprobe.d/disable-algif_aead.conf 2>/dev/null || \

! grep -Fqx 'blacklist algif_aead' /etc/modprobe.d/disable-algif_aead.conf 2>/dev/null; then

tee /etc/modprobe.d/disable-algif_aead.conf > /dev/null <<'EOF'

install algif_aead /bin/false

blacklist algif_aead

EOF

Copilot · 2026-05-01T01:22:41Z

 blacklist usb-storage
+# CVE-2026-31431 (Copy Fail): Disable algif_aead to mitigate LPE vulnerability
+# until kernel fix is available. See https://ubuntu.com/blog/copy-fail-vulnerability-fixes-available
+install algif_aead /bin/false


All existing install rules in this CIS modprobe config use /bin/true (e.g., dccp/sctp/rds/tipc/cramfs/etc.), but this change uses /bin/false for algif_aead. Using /bin/false makes modprobe algif_aead fail instead of succeeding as a no-op, which is a behavioral difference that could break callers expecting modprobe to return success. If failure is not explicitly required, consider aligning with the existing pattern (install algif_aead /bin/true + blacklist algif_aead) or document why a failing install is necessary here.

Suggested change

install algif_aead /bin/false

install algif_aead /bin/true

Devinwong · 2026-05-01T02:41:50Z

Bypassing because it failed with quota exceeded and we are in a rush.

djsly and others added 3 commits April 30, 2026 21:18

Copilot AI review requested due to automatic review settings May 1, 2026 01:19

djsly requested review from AbelHu, Devinwong, SriHarsha001, awesomenix, calvin197, cameronmeissner, ganeshkumarashok, junjiezhang1997, lilypan26, mxj220, pdamianov-dev, phealy, r2k1, sulixu, surajssd, timmy-wright and zachary-bailey as code owners May 1, 2026 01:19

djsly temporarily deployed to test May 1, 2026 01:19 — with GitHub Actions Inactive

Copilot started reviewing on behalf of djsly May 1, 2026 01:20 View session

chore: auto-generate hotfix template entries

42c1c6b

aks-node-assistant Bot temporarily deployed to test May 1, 2026 01:20 Inactive

Copilot AI reviewed May 1, 2026

View reviewed changes

Devinwong merged commit 0b4e798 into official/v20260413 May 1, 2026
22 of 26 checks passed

Devinwong deleted the cherry-pick/official-v20260413/cve-2026-31431 branch May 1, 2026 02:41

djsly mentioned this pull request May 21, 2026

fix: remove AzureLinux 3.0 modprobe LPE blacklist (CSE-time + VHD bake-in) — kernel 6.6.139.1-1.azl3+ fixes upstream #8546

Open

9 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[cherry-pick v20260413] fix: mitigate CVE-2026-31431 (Copy Fail) algif_aead LPE#8443

[cherry-pick v20260413] fix: mitigate CVE-2026-31431 (Copy Fail) algif_aead LPE#8443
Devinwong merged 4 commits into
official/v20260413from
cherry-pick/official-v20260413/cve-2026-31431

djsly commented May 1, 2026

Uh oh!

github-actions Bot commented May 1, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI May 1, 2026

Uh oh!

Copilot AI May 1, 2026

Uh oh!

Devinwong commented May 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		if ! grep -qs "algif_aead" /etc/modprobe.d/*.conf 2>/dev/null; then
		printf "install algif_aead /bin/false\nblacklist algif_aead\n" > /etc/modprobe.d/disable-algif_aead.conf

Conversation

djsly commented May 1, 2026

Changes

CVE Details

Uh oh!

github-actions Bot commented May 1, 2026

Changes cached containers or packages on windows VHDs

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI May 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 1, 2026

Choose a reason for hiding this comment

Uh oh!

Devinwong commented May 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants