##
Slackware Patches "Copy Fail" Kernel Bug — CVE-2026-31431Slackware has issued a kernel security update for **CVE-2026-31431**, the [Copy Fail](https://copy.fail/ ) vulnerability disclosed April 29, 2026. It's an out-of-bounds write in the AEAD userspace crypto interface (AF_ALG) that lets any local user get a root shell via a setuid binary — the same 732-byte Python PoC works on essentially every Linux distro shipped since 2017.
**If you can't patch right away**, Slackware ships the affected code as a module (CONFIG_CRYPTO_USER_API_AEAD=m), so you can blacklist or remove it as a stopgap:echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf<br>rmmod algif_aead<br>
For most systems this breaks nothing — AF_ALG is a userspace front-door to the kernel crypto API, and OpenSSL, SSH, dm-crypt, kTLS, and IPsec all bypass it.
Patch and reboot when you can. slackpkg update && slackpkg upgrade-all.
**Sources:**<li><a href="http://www.slackware.com/security/viewer.php?l=slackware-security&y=2026&m=slackware-security.1267034"; target="_blank">http://www.slackware.com/security/viewer.php?l=slackware-security&y=2026&m=slackware-security.1267034</a></li><li><a href="https://www.cve.org/CVERecord?id=CVE-2026-31431"; target="_blank">https://www.cve.org/CVERecord?id=CVE-2026-31431</a></li>;
#slackware #copyfail
r1w1s1
npub177…teh9a
2026-05-03 02:59:54 UTC
Author Public Key
npub1773c2kdhaf88lk6nntdudn2p74egzurcs528cnmltl6vmshltu2q0teh9aSeen on
wss://relay.momostr.pinkPublished at
2026-05-03 02:59:54 UTCEvent JSON
{
"id": "f5af9b0fb1f2e903413787546fc8b4278eb6a352091b64d87e9a94a8767de03b",
"pubkey": "f7a38559b7ea4e7fdb539adbc6cd41f57281707885147c4f7f5ff4cdc2ff5f14",
"created_at": 1777777194,
"kind": 1,
"tags": [
[
"t",
"copyfail"
],
[
"proxy",
"https://snac.bsd.cafe/r1w1s1/p/1777777194.498875",
"web"
],
[
"t",
"slackware"
],
[
"proxy",
"https://snac.bsd.cafe/r1w1s1/p/1777777194.498875",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://snac.bsd.cafe/r1w1s1/p/1777777194.498875",
"pink.momostr"
],
[
"-"
]
],
"content": "## \n\nSlackware Patches \"Copy Fail\" Kernel Bug — CVE-2026-31431Slackware has issued a kernel security update for **CVE-2026-31431**, the [Copy Fail](https://copy.fail/ ) vulnerability disclosed April 29, 2026. It's an out-of-bounds write in the AEAD userspace crypto interface (AF_ALG) that lets any local user get a root shell via a setuid binary — the same 732-byte Python PoC works on essentially every Linux distro shipped since 2017.\n\n**If you can't patch right away**, Slackware ships the affected code as a module (CONFIG_CRYPTO_USER_API_AEAD=m), so you can blacklist or remove it as a stopgap:echo \"install algif_aead /bin/false\" \u0026gt; /etc/modprobe.d/disable-algif.conf\u003cbr\u003ermmod algif_aead\u003cbr\u003e\n\nFor most systems this breaks nothing — AF_ALG is a userspace front-door to the kernel crypto API, and OpenSSL, SSH, dm-crypt, kTLS, and IPsec all bypass it.\n\nPatch and reboot when you can. slackpkg update \u0026amp;\u0026amp; slackpkg upgrade-all.\n\n**Sources:**\u003cli\u003e\u003ca href=\"http://www.slackware.com/security/viewer.php?l=slackware-security\u0026amp;y=2026\u0026amp;m=slackware-security.1267034\" target=\"_blank\"\u003ehttp://www.slackware.com/security/viewer.php?l=slackware-security\u0026amp;y=2026\u0026amp;m=slackware-security.1267034\u003c/a\u003e\u003c/li\u003e\u003cli\u003e\u003ca href=\"https://www.cve.org/CVERecord?id=CVE-2026-31431\" target=\"_blank\"\u003ehttps://www.cve.org/CVERecord?id=CVE-2026-31431\u003c/a\u003e\u003c/li\u003e\n#slackware #copyfail",
"sig": "c12383740fc44dd3a1790a148d42a850af0b4745a7c9837e3d7f5a8556bed044437b5c4cbf7916c8fb6a27c854c796a8205c4abcf80a6ce81737c93d9a5cb7f0"
}