copy-fail-destroyer

A Kubernetes DaemonSet agent that detects and remediates CVE-2026-31431 ("Copy Fail") — an algif_aead in-place logic flaw in the Linux kernel allowing unprivileged page-cache writes via the AF_ALG socket interface.

What it does

On each node the agent runs a loop every 5 minutes that:

1. Checks the kernel version against all known patched stable branches.
2. Probes the AF_ALG module by attempting to create and bind an AF_ALG socket to aead / authenc(hmac(sha256),cbc(aes)) — the exact algorithm the exploit targets. This is safe and non-destructive.
3. Remediates based on the configured REMEDIATION_MODE (see below).
4. Exposes Prometheus metrics so you can alert and track status across the fleet.

Remediation modes

Set via the REMEDIATION_MODE environment variable (or remediationMode in the Helm chart):

Mode	Behaviour
unload (default)	Unloads the algif_aead kernel module via delete_module
blacklist	Unloads the module and writes a modprobe blacklist rule to prevent auto-reload
remove	Unloads, blacklists, and deletes the algif_aead.ko file from /lib/modules/$(uname -r)/... so the module cannot be loaded again — even after a reboot or removal of the blacklist. Runs every cycle even when the module is currently unreachable (e.g., already blocked by a blacklist) so a re-installed .ko file is caught on the next loop. Requires /lib/modules mounted read-write (the Helm chart does this automatically when this mode is set). Built-in modules cannot be removed this way.
disabled	Detect and report only — no remediation is performed

Prometheus metrics

All metrics are exposed on :9100/metrics.

Metric	Description
cve_2026_31431_kernel_needs_patching	1 if the kernel version is not patched for CVE-2026-31431
cve_2026_31431_vulnerable	1 if the kernel is vulnerable to CVE-2026-31431 and the module is reachable
cve_2026_31431_module_reachable	1 if the AF_ALG aead algorithm can be bound
cve_2026_31431_remediation_applied	1 if the algif_aead module was successfully unloaded

Patched kernel versions

CVE-2026-31431 (Copy Fail)

• 7.0+ (mainline)
• 6.19.12+, 6.18.22+
• Kernels before 4.14 are not affected (bug introduced in 4.14)

Project structure

cmd/destroyer/main.go          # Entry point — metrics server, check loop, remediation
pkg/detector/
  cve202631431.go              # CVE-2026-31431 (Copy Fail) detection
  probe_linux.go               # AF_ALG module probe (Linux)
  probe_other.go               # Probe stub (non-Linux)
  remediate_linux.go           # Module unload via delete_module (Linux)
  remediate_other.go           # Remediation stub (non-Linux)
deploy/namespace.yaml          # Namespace with Pod Security Admission policy
deploy/daemonset.yaml          # Kubernetes DaemonSet manifest
Dockerfile                     # Multi-stage build (scratch final image)

Building

# Native
go build ./cmd/destroyer

# Linux cross-compile (for container image)
CGO_ENABLED=0 GOOS=linux go build -o destroyer ./cmd/destroyer

Container image

docker build -t copy-fail-destroyer .

Deployment

The agent requires a privileged security context to unload kernel modules and probe AF_ALG sockets. The root filesystem is read-only.

Raw manifests

kubectl apply -f deploy/namespace.yaml
kubectl apply -f deploy/daemonset.yaml

Helm

helm install copy-fail-destroyer oci://ghcr.io/norskhelsenett/helm/copy-fail-destroyer \
  --namespace copy-fail-destroyer --create-namespace

Override the remediation mode:

helm install copy-fail-destroyer oci://ghcr.io/norskhelsenett/helm/copy-fail-destroyer \
  --namespace copy-fail-destroyer --create-namespace \
  --set remediationMode=disabled

ArgoCD

An Application manifest is provided at deploy/argocd-application.yaml. Edit targetRevision to pin a chart version:

kubectl apply -f deploy/argocd-application.yaml

The DaemonSet includes Prometheus scrape annotations (prometheus.io/scrape: "true", port 9100).

Prometheus Operator

If you use the Prometheus Operator, deploy the PodMonitor to have metrics scraped automatically:

# Raw manifest
kubectl apply -f deploy/podmonitor.yaml

# Or via Helm
helm install copy-fail-destroyer oci://ghcr.io/norskhelsenett/helm/copy-fail-destroyer \
  --namespace copy-fail-destroyer --create-namespace \
  --set metrics.podMonitor.enabled=true

Alert rules (PrometheusRule) for Alertmanager are also available:

# Raw manifest
kubectl apply -f deploy/prometheusrule.yaml

# Or via Helm with extra alert labels
helm install copy-fail-destroyer oci://ghcr.io/norskhelsenett/helm/copy-fail-destroyer \
  --namespace copy-fail-destroyer --create-namespace \
  --set metrics.prometheusRule.enabled=true \
  --set metrics.prometheusRule.extraAlertLabels.team=platform

Three alerts are defined:

Alert	Severity	Description
CopyFailVulnerable	critical	Kernel is vulnerable and AF_ALG module is reachable
CopyFailKernelNeedsPatching	warning	Kernel version is unpatched (module may be mitigated)
CopyFailRemediationFailed	warning	Module still reachable after remediation attempt

CI/CD

A GitHub Actions workflow (.github/workflows/build.yaml) triggers on versioned tags (v*). It:

1. Runs go test ./...
2. Builds the Linux binary
3. Builds and pushes a container image to ghcr.io/norskhelsenett/copy-fail-destroyer
4. Packages and pushes the Helm chart to oci://ghcr.io/norskhelsenett/helm/copy-fail-destroyer

Tags are derived from the Git tag — e.g. pushing v1.2.3 produces image tags 1.2.3 and 1.2.

git tag v1.0.0
git push origin v1.0.0