Copy-Fail-Destroyer: A Kubernetes DaemonSet Agent for Detecting and Remediating Linux Kernel CVE-2026-31431
By
evenh
Kettled twice. Extra chewy, extra trustworthy.
Summary
A Kubernetes DaemonSet agent called "copy-fail-destroyer" that detects and remediates CVE-2026-31431 ("Copy Fail"), a Linux kernel vulnerability in the algif_aead module. The agent runs on each node every 5 minutes, checking kernel versions against known patched branches and probing the AF_ALG module safely. It then remediates based on a configured mode. The project is hosted on GitHub under NorskHelsenett.
Key quotes
· 3 pulledA Kubernetes DaemonSet agent that detects and remediates CVE-2026-31431 ("Copy Fail") — an algif_aead in-place logic flaw in the Linux kernel allowing unprivileged page-cache writes via the AF_ALG socket interface.
On each node the agent runs a loop every 5 minutes that checks the kernel version against all known patched stable branches.
Probes the AF_ALG module by attempting to create and bind an AF_ALG socket to aead / authenc(hmac(sha256),cbc(aes)) — the exact algorithm the exploit targets. This is safe and non-destructive.
You might also wanna read
Composer vulnerability leaks GitHub Actions GITHUB_TOKEN in logs due to format mismatch
A security vulnerability has been identified where Composer leaks the full contents of GitHub OAuth tokens (specifically GITHUB_TOKEN) to st
github.com·18d ago
Layerleak: Docker Hub Secret Scanner Tool Documentation
Layerleak is a Docker Hub secret scanner tool that detects sensitive information in Docker images. The article provides technical documentat
github.com·2mo ago
FIPS Compliance Challenges in Containerized Applications: Why Base Images Aren't Enough
The article discusses the challenges of achieving FIPS (Federal Information Processing Standards) compliance in containerized applications,
docker.com·4mo ago
lockenv: Password-Based Encrypted Vault for .env and Infrastructure Secrets
lockenv is a simple, password-based encrypted vault tool for securely storing sensitive files like .env files and infrastructure secrets in
github.com·5mo ago
Kekkai: A Go-Based File Integrity Monitoring Tool for Security Protection
Kekkai is a lightweight Go tool designed for file integrity monitoring that detects unauthorized file modifications by comparing content-bas
github.com·8mo ago
Keeping Secrets Out of Logs: A Defense-in-Depth Approach
This article discusses strategies for preventing sensitive data (secrets, credentials, PII) from being written to application logs. The auth