Disabling the AF_ALG protocol family on Alibaba Cloud Linux - Alibaba Cloud Linux

CVE-2026-31431 is a high-severity local privilege escalation vulnerability in the Linux kernel. This document describes how to apply an interim mitigation by disabling AF_ALG socket creation using a livepatch RPM — without rebooting. Apply this mitigation only if your services do not depend on AF_ALG sockets.

Warning

After you deploy this solution, any process that depends on AF_ALG sockets will fail to create them, which can make your services unavailable. Do not deploy this solution unless you are certain your services do not depend on AF_ALG sockets.
This solution introduces stability risks. Roll it out gradually using a phased approach — do not deploy to your entire production environment at once.
During the phased rollout, closely monitor service stability, error logs, and performance metrics. Roll back immediately if you detect any anomalies.

Background

CVE-2026-31431 is a high-severity local privilege escalation vulnerability in the algif_aead module of the Linux kernel.

By crafting a specific sequence of AF_ALG socket calls combined with the splice() system call, an attacker can bypass standard permission checks and perform a 4-byte unauthorized write to the page cache of an arbitrary file. Attackers exploit this to tamper with the in-memory image of setuid programs such as /usr/bin/su, escalating from a regular user to root without modifying the on-disk file content.

For details, see [Security Advisory] Risk of local privilege escalation vulnerability in Linux kernel (CVE-2026-31431).

Limitations

This mitigation disables all encryption and decryption operations that use AF_ALG sockets at the kernel level. Services that rely on these operations will stop working. Determine whether your services depend on AF_ALG sockets before applying this mitigation. If you are unsure whether your services depend on the AF_ALG socket feature, do not proceed.

To check whether your services use AF_ALG sockets for kernel-level cryptographic operations, use auditd or eBPF (extended Berkeley Packet Filter) to monitor AF_ALG socket creation. The following example uses auditd:

# First, ensure the auditd service is enabled.
systemctl start auditd

# If other audit rules are already configured on the system, back them up and assess the impact first.
# Add an audit rule for AF_ALG sockets.
auditctl -a always,exit -F arch=b64 -S socket -F a0=38 -k afalg_socket

# After a period of time, check the audit results.
ausearch -k afalg_socket -ts recent -i

# Expected result: If any process created an AF_ALG socket during this period, audit records are displayed.

# When you are finished, delete the audit rule for AF_ALG sockets.
auditctl -d always,exit -F arch=b64 -S socket -F a0=38 -k afalg_socket

Note

These checks are for reference only and cannot completely rule out a dependency on AF_ALG. Also review your application source code, dependency list, and runtime behavior.

Apply the mitigation

Important

Before proceeding, confirm that your services do not depend on AF_ALG socket functionality and that you can accept the limitations on AF_ALG-related features.

Step 1: Check prerequisites

Before deploying, verify that your system meets both of the following conditions:

The kernel has livepatch support enabled.
The kernel-devel package for the current kernel version is installed.

# 1. Check whether the kernel-devel package for the running kernel is installed.
test -d "/lib/modules/$(uname -r)/build" && echo "kernel-devel OK" || echo "Please install kernel-devel-$(uname -r)"

# If the package is missing, install it:
sudo yum install -y kernel-devel-$(uname -r)

# 2. Check whether livepatch support is enabled in the kernel.
test -d /sys/kernel/livepatch && echo "livepatch sysfs OK"

Step 2: Install the RPM package

# 1. Download the RPM package for your operating system version. (The download links are protected by an allowlist. To get an authorized link, join DingTalk group 179525012975.)

# 2. Install the RPM package. For example, on Alibaba Cloud Linux 3:
sudo yum install disable-af-alg-livepatch-1.0.0-1.al8.noarch.rpm

If you update the kernel, reinstall the corresponding RPM package for the mitigation to remain active.

Step 3: Verify the mitigation

Method 1: Check livepatch status

This method applies to Alibaba Cloud Linux 3 and Alibaba Cloud Linux 4:

# Check the livepatch status.
kpatch list

# Expected output: "disable_af_alg [enabled]" appears in the "Loaded patch modules:" list.

Method 2: Verify AF_ALG socket blocking

Run the following Python script to confirm that AF_ALG socket creation is blocked:

python3 - <<'PY'
import socket, errno
try:
    s = socket.socket(38, socket.SOCK_SEQPACKET, 0)  # 38 = AF_ALG
    print("AF_ALG socket create: SUCCESS (Mitigation is not effective)")
    s.close()
except OSError as e:
    if e.errno == errno.EAFNOSUPPORT:
        print(f"AF_ALG socket create: FAILED (Mitigation is effective)")
    else:
        print(f"AF_ALG socket create: FAILED (Unexpected error),errno={e.errno}, msg={e.strerror}")
PY

Rollback

If you encounter service issues after deployment, uninstall the mitigation:

sudo yum remove disable-af-alg-livepatch

After uninstalling, run the verification script to confirm that AF_ALG socket interception is removed.