# Kernel privilege escalation: CVE-2026-31431 (Copy Fail)
Source: https://docs.webgee.com/en/servers/kernel-cve-2026-31431



**Audience:** WebGee VPS and dedicated server customers running Linux.

<Callout type="error">
  **CVE-2026-31431**, publicised as **Copy Fail**, allows a **local unprivileged
  user to escalate to root** on affected systems.

  "Local" is less reassuring than it sounds. Any code running as a non-root
  user — a vulnerable CMS, a compromised plugin, a web shell dropped through an
  outdated WordPress site — can be chained into full control of the server.
  Treat it as urgent.
</Callout>

## What to do [#what-to-do]

1. **Check whether you are exposed** (below).
2. **Apply the short-term mitigation** if you are, blocking the `algif_aead`
   module.
3. **Update your kernel** when your distribution ships a fixed package, and
   **reboot** — the mitigation is a stopgap, not a fix.

Shared, reseller and Premium hosting customers need do nothing. WebGee patches
those servers.

## Check your server [#check-your-server]

WebGee provides a script that reports whether your running kernel appears
patched, whether the module is present or loaded, and can apply the mitigation
for you.

As root:

```bash
wget -qO- https://security.webgee.com/scripts/copyfail-check.sh | bash
```

Or by hand:

```bash
# Your running kernel
uname -r

# Is the affected module loaded?
lsmod | grep algif_aead
```

Compare your kernel version against your distribution's advisory — the fixed
version differs between AlmaLinux, Debian, Ubuntu and Rocky.

## Apply the mitigation [#apply-the-mitigation]

Blocks the module from loading, and unloads it if it is loaded and not in use:

```bash
echo "install algif_aead /bin/true" > /etc/modprobe.d/blacklist-algif_aead.conf
modprobe -r algif_aead
```

The first line survives reboots. The second takes effect immediately, and fails
harmlessly if something is using the module — in which case a reboot applies it.

<Callout type="warn">
  `algif_aead` exposes kernel crypto to userspace. Almost nothing uses it, but
  some VPN and disk-encryption tooling does. Test that your services still work
  after applying this, particularly if you run IPsec or anything using the
  kernel crypto API.
</Callout>

## Then update the kernel [#then-update-the-kernel]

The mitigation blocks one route. Updating fixes the flaw:

```bash
# Debian / Ubuntu
apt update && apt upgrade

# AlmaLinux / Rocky
dnf upgrade

reboot
```

<Callout type="warn">
  **A kernel update does nothing until you reboot.** The running kernel is the
  one loaded at boot, so a server that has been updated but not restarted is
  still exposed. Confirm with `uname -r` afterwards.
</Callout>

Once running a fixed kernel, you can remove the mitigation file if the module is
needed:

```bash
rm /etc/modprobe.d/blacklist-algif_aead.conf
```

## Reduce your exposure regardless [#reduce-your-exposure-regardless]

This flaw needs local code execution to exploit, so the same measures that
prevent that help here:

* **Update applications**, particularly WordPress plugins — see
  [Clean malware from your website](/en/security-ssl/steps-to-cleaning-malware-from-your-website).
* **Use SSH keys rather than passwords** — see
  [Add an SSH key](/en/servers/ssh-keys).
* **Remove unused accounts and services.**

## Managed customers [#managed-customers]

Servers on a management plan are patched by WebGee — see
[What server management includes](/en/servers/vps-cloud-server-management-whats-included).
Unmanaged servers are yours to update, and nobody else will.

## Related [#related]

* [What server management includes](/en/servers/vps-cloud-server-management-whats-included)
* [Rescue mode and VNC](/en/servers/rescue-mode-and-vnc)