Alibaba Cloud Linux:Mitigation for disabling AF_ALG on Alibaba Cloud Linux

Background

CVE-2026-31431 is a high-severity local privilege escalation vulnerability in the Linux kernel's algif_aead module.

An attacker can exploit this vulnerability by crafting a specific sequence of AF_ALG socket calls. In combination with the splice() system call, this allows them to bypass standard permission checks and perform a 4-byte out-of-bounds write to an arbitrary page cache.

An attacker can leverage this capability to tamper with the in-memory image of a setuid program, such as /usr/bin/su. This allows them to escalate from a regular user to root privilege without modifying the file's content on disk.

For more details, see the security advisory: [Vulnerability Bulletin] Linux Kernel Local Privilege Escalation Vulnerability Risk Advisory (CVE-2026-31431).

Limitations

This mitigation solution makes the encryption and decryption functions that depend on AF_ALG sockets unavailable. This may affect services that rely on encryption and decryption functions. Before you implement this solution, you must evaluate whether your services have a dependency on AF_ALG sockets. If you cannot confirm whether your services depend on the AF_ALG socket feature, do not use this mitigation solution.

This section provides methods to check if your workloads use the kernel's cryptographic API through AF_ALG sockets. You can use tools like auditd or eBPF to check for AF_ALG socket creation activity on your machine. The following example uses auditd:

# First, ensure the auditd service is enabled
systemctl start auditd

# If your system has other audit rules configured, back them up and assess the impact first
# Add an audit rule for AF_ALG socket creation
auditctl -a always,exit -F arch=b64 -S socket -F a0=38 -k afalg_socket

# After letting it run for a while, check the audit results
ausearch -k afalg_socket -ts recent -i

# Expected result: If any process created an AF_ALG socket during this period, audit records will be displayed

# When finished, delete the audit rule for the AF_ALG socket
auditctl -d always,exit -F arch=b64 -S socket -F a0=38 -k afalg_socket

Procedure

# 1. Confirm that the kernel-devel package is installed
# Check if the kernel-devel package for the current kernel version is installed
test -d "/lib/modules/$(uname -r)/build" && echo "kernel-devel OK" || echo "Please install kernel-devel-$(uname -r)"

# If you need to install the kernel-devel package manually
sudo yum install -y kernel-devel-$(uname -r)

# 2. Confirm that the kernel has livepatch support enabled
test -d /sys/kernel/livepatch && echo "livepatch sysfs OK"

# 1. Download the RPM package for your operating system version. (The package URL is on an allowlist. Obtain the download link from DingTalk group 23149462.)

# 2. Install the corresponding RPM package for your operating system version. For example, on Alibaba Cloud Linux 3:
sudo yum install disable-af-alg-livepatch-1.0.0-1.al8.noarch.rpm

# Check the livepatch status
kpatch list

# Expected output: The mitigation is active if "disable_af_alg [enabled]" appears under "Loaded patch modules:".

python3 - <<'PY'
import socket, errno
try:
    s = socket.socket(38, socket.SOCK_SEQPACKET, 0)  # 38 = AF_ALG
    print("AF_ALG socket create: SUCCESS (Mitigation not active)")
    s.close()
except OSError as e:
    if e.errno == errno.EAFNOSUPPORT:
        print(f"AF_ALG socket create: FAILED (Mitigation active)")
    else:
        print(f"AF_ALG socket create: FAILED (Returned unexpected error),errno={e.errno}, msg={e.strerror}")
PY

Rollback

If you encounter workload issues after deployment, uninstall the mitigation solution:

sudo yum remove disable-af-alg-livepatch

After the uninstallation is complete, run the verification script again to confirm that AF_ALG socket creation is no longer blocked.