[cherry-pick v20260424] fix: mitigate CVE-2026-31431 (Copy Fail) algif_aead LPE by djsly · Pull Request #8444 · Azure/AgentBaker

djsly · 2026-05-01T01:19:47Z

Cherry-pick of CVE-2026-31431 mitigation from PR #8437 to release branch official/v20260424.

Changes

modprobe-CIS.conf: Block algif_aead module (install + blacklist)
cse_main.sh: Runtime mitigation for existing VHDs (Ubuntu + AzureLinux)

CVE Details

CVE-2026-31431 — Local privilege escalation (CVSS 7.8 HIGH) via algif_aead kernel module
No kernel fix available yet — mitigation disables the module
AB#37761004

Disable algif_aead kernel module to mitigate local privilege escalation vulnerability (CVSS 7.8 HIGH) until kernel fix is available (~21 days). VHD build: Add 'install algif_aead /bin/false' to modprobe-CIS.conf CSE provisioning: Apply runtime mitigation on existing VHDs (creates modprobe config + rmmod if module is loaded) Per Canonical advisory: https://ubuntu.com/blog/copy-fail-vulnerability-fixes-available AB#37761004 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The algif_aead vulnerability affects all Linux kernels >=4.15, not just Ubuntu. Extend CSE runtime mitigation to also cover AzureLinux/Mariner. VHD build was already covered since modprobe-CIS.conf is shared across all OS builds (Ubuntu, AzureLinux, ACL, Flatcar). Ubuntu 20.04 FIPS is also covered (same shared config + CSE path). AB#37761004 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Add 'blacklist algif_aead' alongside install rule for CIS consistency - Log success/failure of rmmod with actionable reboot guidance - Only attempt rmmod when module is actually loaded AB#37761004 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-05-01T01:21:32Z

Changes cached containers or packages on windows VHDs

Please get a Windows SIG member to approve.

The following dif file shows any additions or deletions from what will be cached on windows VHDs organised by VHD type.

Additions are new things cached.
Deletions are things no longer cached.

diff --git a/vhd_files/2022-containerd-gen2.txt b/vhd_files/2022-containerd-gen2.txt
index a67cc2d..1005317 100644
--- a/vhd_files/2022-containerd-gen2.txt
+++ b/vhd_files/2022-containerd-gen2.txt
@@ -4 +4 @@ c:\akse-cache\: https://packages.aks.azure.com/ccgakvplugin/v1.1.5/binaries/wind
-c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.1/windows-amd64.zip
+c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.0/windows-amd64.zip
diff --git a/vhd_files/2022-containerd.txt b/vhd_files/2022-containerd.txt
index abc0646..9fc80b7 100644
--- a/vhd_files/2022-containerd.txt
+++ b/vhd_files/2022-containerd.txt
@@ -4 +4 @@ c:\akse-cache\: https://packages.aks.azure.com/ccgakvplugin/v1.1.5/binaries/wind
-c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.1/windows-amd64.zip
+c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.0/windows-amd64.zip
diff --git a/vhd_files/2025-gen2.txt b/vhd_files/2025-gen2.txt
index 7c9a9ca..aef5fe3 100644
--- a/vhd_files/2025-gen2.txt
+++ b/vhd_files/2025-gen2.txt
@@ -4 +4 @@ c:\akse-cache\: https://packages.aks.azure.com/ccgakvplugin/v1.1.5/binaries/wind
-c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.1/windows-amd64.zip
+c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.0/windows-amd64.zip
diff --git a/vhd_files/2025.txt b/vhd_files/2025.txt
index 9a53a2a..ce16499 100644
--- a/vhd_files/2025.txt
+++ b/vhd_files/2025.txt
@@ -4 +4 @@ c:\akse-cache\: https://packages.aks.azure.com/ccgakvplugin/v1.1.5/binaries/wind
-c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.1/windows-amd64.zip
+c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.0/windows-amd64.zip
diff --git a/vhd_files/23H2-gen2.txt b/vhd_files/23H2-gen2.txt
index baa32a3..719173c 100644
--- a/vhd_files/23H2-gen2.txt
+++ b/vhd_files/23H2-gen2.txt
@@ -4 +4 @@ c:\akse-cache\: https://packages.aks.azure.com/ccgakvplugin/v1.1.5/binaries/wind
-c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.1/windows-amd64.zip
+c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.0/windows-amd64.zip
diff --git a/vhd_files/23H2.txt b/vhd_files/23H2.txt
index b30587b..01bb92f 100644
--- a/vhd_files/23H2.txt
+++ b/vhd_files/23H2.txt
@@ -4 +4 @@ c:\akse-cache\: https://packages.aks.azure.com/ccgakvplugin/v1.1.5/binaries/wind
-c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.1/windows-amd64.zip
+c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.0/windows-amd64.zip

Copilot

Pull request overview

Cherry-picks a mitigation for CVE-2026-31431 by preventing the algif_aead kernel module from being loaded on new VHDs (via modprobe config) and applying a runtime safeguard during provisioning (via CSE) for existing VHDs.

Changes:

Update shared CIS modprobe configuration to disable algif_aead.
Add CSE runtime logic to ensure a disabling modprobe rule exists and attempt to unload algif_aead if currently loaded.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
parts/linux/cloud-init/artifacts/modprobe-CIS.conf	Adds `algif_aead` install/blacklist rules to mitigate the CVE at build-time for new VHDs.
parts/linux/cloud-init/artifacts/cse_main.sh	Adds provisioning-time mitigation to create a disable rule and unload the module on Ubuntu/AzureLinux/Mariner for existing VHDs.

Copilot · 2026-05-01T01:22:49Z

 blacklist usb-storage
+# CVE-2026-31431 (Copy Fail): Disable algif_aead to mitigate LPE vulnerability
+# until kernel fix is available. See https://ubuntu.com/blog/copy-fail-vulnerability-fixes-available
+install algif_aead /bin/false


modprobe-CIS.conf consistently disables modules with install <module> /bin/true + blacklist <module>, but this change uses /bin/false for algif_aead. Using /bin/false makes modprobe algif_aead fail and could cause unexpected failures in any consumers that attempt to load it. Consider aligning to /bin/true like the other entries, or add a short note explaining why algif_aead is intentionally different here.

Suggested change

install algif_aead /bin/false

install algif_aead /bin/true

Copilot · 2026-05-01T01:22:50Z

+        if ! grep -qs "algif_aead" /etc/modprobe.d/*.conf 2>/dev/null; then
+            printf "install algif_aead /bin/false\nblacklist algif_aead\n" > /etc/modprobe.d/disable-algif_aead.conf


The idempotency check treats any occurrence of the string algif_aead in any /etc/modprobe.d/*.conf as “already mitigated”. That can produce false positives (e.g., comments/aliases) and skip writing the required install ... /bin/false + blacklist ... rules. Consider checking specifically for the required directives (or ensuring the expected file exists with correct contents) before deciding to skip creating/updating the mitigation file.

Suggested change

if ! grep -qs "algif_aead" /etc/modprobe.d/*.conf 2>/dev/null; then

printf "install algif_aead /bin/false\nblacklist algif_aead\n" > /etc/modprobe.d/disable-algif_aead.conf

if ! grep -qsE '^[[:space:]]*install[[:space:]]+algif_aead[[:space:]]+/bin/false([[:space:]]|$)' /etc/modprobe.d/disable-algif_aead.conf 2>/dev/null || \

! grep -qsE '^[[:space:]]*blacklist[[:space:]]+algif_aead([[:space:]]|$)' /etc/modprobe.d/disable-algif_aead.conf 2>/dev/null; then

tee /etc/modprobe.d/disable-algif_aead.conf > /dev/null <<'EOF'

install algif_aead /bin/false

blacklist algif_aead

EOF

Copilot · 2026-05-01T01:22:50Z

+        if grep -q '^algif_aead ' /proc/modules 2>/dev/null; then
+            if rmmod algif_aead 2>/dev/null; then
+                echo "CVE-2026-31431: successfully unloaded algif_aead module"
+            else
+                echo "CVE-2026-31431: failed to unload algif_aead (in use), reboot required for full mitigation"
+            fi


rmmod algif_aead will fail if the module has dependents, even when unloading would otherwise be possible. Using modprobe -r algif_aead is generally more robust because it removes dependencies in the right order and yields clearer failure modes for the “reboot required” message.

Devinwong · 2026-05-01T02:41:34Z

Bypassing because it failed with quota exceeded and we are in a rush.

djsly and others added 3 commits April 30, 2026 21:19

Copilot AI review requested due to automatic review settings May 1, 2026 01:19

djsly requested review from AbelHu, Devinwong, SriHarsha001, awesomenix, calvin197, cameronmeissner, ganeshkumarashok, junjiezhang1997, lilypan26, mxj220, pdamianov-dev, phealy, r2k1, sulixu, surajssd, timmy-wright and zachary-bailey as code owners May 1, 2026 01:19

djsly temporarily deployed to test May 1, 2026 01:19 — with GitHub Actions Inactive

Copilot started reviewing on behalf of djsly May 1, 2026 01:20 View session

chore: auto-generate hotfix template entries

633fdbd

aks-node-assistant Bot temporarily deployed to test May 1, 2026 01:20 Inactive

Copilot AI reviewed May 1, 2026

View reviewed changes

Devinwong merged commit 8ad5e47 into official/v20260424 May 1, 2026
20 of 26 checks passed

Devinwong deleted the cherry-pick/official-v20260424/cve-2026-31431 branch May 1, 2026 02:41

djsly mentioned this pull request May 21, 2026

fix: remove AzureLinux 3.0 modprobe LPE blacklist (CSE-time + VHD bake-in) — kernel 6.6.139.1-1.azl3+ fixes upstream #8546

Open

9 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[cherry-pick v20260424] fix: mitigate CVE-2026-31431 (Copy Fail) algif_aead LPE#8444

[cherry-pick v20260424] fix: mitigate CVE-2026-31431 (Copy Fail) algif_aead LPE#8444
Devinwong merged 4 commits into
official/v20260424from
cherry-pick/official-v20260424/cve-2026-31431

djsly commented May 1, 2026

Uh oh!

github-actions Bot commented May 1, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI May 1, 2026

Uh oh!

Copilot AI May 1, 2026

Uh oh!

Copilot AI May 1, 2026

Uh oh!

Devinwong commented May 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		if ! grep -qs "algif_aead" /etc/modprobe.d/*.conf 2>/dev/null; then
		printf "install algif_aead /bin/false\nblacklist algif_aead\n" > /etc/modprobe.d/disable-algif_aead.conf

Conversation

djsly commented May 1, 2026

Changes

CVE Details

Uh oh!

github-actions Bot commented May 1, 2026

Changes cached containers or packages on windows VHDs

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI May 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 1, 2026

Choose a reason for hiding this comment

Uh oh!

Devinwong commented May 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants