CopyFail Was Not Disclosed to Distros

Source: Hacker News

Discussion

On 29/04/2026 21:23, Jan Schaumann wrote:

Affected and fixed versions

Issue introduced in 4.14 with commit
72548b093ee38a6d4f2a19e6ef1948ae05c181f7 and fixed in
6.18.22 with commit fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8

Issue introduced in 4.14 with commit
72548b093ee38a6d4f2a19e6ef1948ae05c181f7 and fixed in
6.19.12 with commit ce42ee423e58dffa5ec03524054c9d8bfd4f6237

Issue introduced in 4.14 with commit
72548b093ee38a6d4f2a19e6ef1948ae05c181f7 and fixed in
7.0 with commit a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5

Links:

So this is one of the worst make‑me‑root vulnerabilities in the kernel in recent times. I see that on the 11th of April 6.19.12 & 6.18.22 were released with the fix back‑ported.

Long‑term 6.12, 6.6, 6.1, 5.15, 5.10 have not received the fix and I don’t see anything in the upstream stable queues yet as I write. My guess is back‑porting that far back is not as straightforward. As this was introduced in 2017 all those older kernels are affected, right? Or am I missing something?

It does not apply cleanly, no. Attached is the workaround we’re going to use. I’m not an expert on IPsec but I think this is the lesser evil.

I attempted a backport but ran into a few API changes and wasn’t confident enough to muck around with it, especially for something to deploy immediately.

[…]

What went wrong, has the embargo been broken early today? Not looking to point any fingers, those who make things happen in our communities work damn hard and deserve respect and support, especially with the extra burden of AI slop now.

Note that for Linux kernel vulnerabilities, unless the reporter chooses to bring it to the linux‑distros mailing list, there is no heads‑up to distributions.

It did not happen here.

Eddie

— Sam

Attachments

• 0001-crypto-disable-authencesn-module-for-CVE-2026-31431.patch (text/x-patch, 1543 bytes)
• signature.asc (application/pgp-signature, 419 bytes)