
Safe read-only check script for Copy Fail / CVE-2026-31431
Hi,
I created a small Bash script to help Linux admins safely check systems for the known algif_aead-based Copy Fail / CVE-2026-31431 attack path.
The goal is to provide a defensive check without running exploit code.
What it does:
- checks whether
algif_aeadis currently loaded - checks whether
algif_aeadcan be loaded viamodprobedry-run - checks for modprobe block rules
- checks Debian/Ubuntu kernel/kmod update status
- checks whether a reboot is required
- prints a clear final result for non-specialists
What it does not do:
- does not run exploit code
- does not modify the system
- does not download additional payloads
- does not attempt privilege escalation
GitHub:
https://github.com/waltrone1/copyfail-safe-check
I mainly built this because I did not want to run public PoC exploit code on production systems just to check exposure.
Feedback, improvements, and distro-specific suggestions are welcome.