Vulnerability vector:
- Base vulnerability score (CVSSv3.1): CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity (CVSSv3.1): 7.8 (high)
- Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Severity (CVSSv4.0): 8.5 (high)
Description:
This security advisory provides information regarding a Linux kernel vulnerability, CVE-2026-31431, informally known as Copy Fail. This vulnerability allows for local privilege escalation to the superuser (root) level and affects the Linux kernel module: algif_aead.
Vulnerability status: PT NGFW is not affected
Recommendations:
In the default configuration, all models and versions of PT NGFW are not vulnerable to CVE-2026-31431, as the vulnerable module algif_aead is not loaded in the Linux kernel.
To verify that the module is not loaded, follow the procedure below. Commands to prevent the vulnerable module from loading are listed below.
To check if vulnerable modules are loaded: lsmod | grep algif_aead or kmod list | grep algif_aead
- If the modules are not loaded, no further action is required.
- If the modules are loaded, unload them manually using the following commands: sudo rmmod algif_aead
To forcibly prevent vulnerable modules from loading: sudo nano /etc/modprobe.d/disable-algif-aead.conf
- Add the following lines to the file: install algif_aead /bin/true
- Update the current initramfs image: sudo update-initramfs -uk all
- Clear the RAM page cache: sudo sh -c "echo 3 > /proc/sys/vm/drop_caches"
- Reboot the PT NGFW: sudo reboot
Additional information:
Refer to Astra Linux recommendations for disabling the vulnerable module.
If you have any further questions, please contact PT NGFW Technical Support or your account manager.