All Products
Search

This Product

    :CVE-2026-31431: Impact and remediation on official images

    Document Center

    :CVE-2026-31431: Impact and remediation on official images

    Last Updated:May 11, 2026

    [Updated on May 11, 2026] This document outlines the impact of the CVE-2026-31431 (Copy Fail) security vulnerability on Alibaba Cloud ECS official Linux images, the image remediation plan, and how to fix existing instances.

    Impact scope, community status, and ECS remediation

    Distribution

    Affected versions

    Permanent fix

    Mitigation

    ECS image status

    Alibaba Cloud Linux

    2–4

    Upgrade the kernel package and reboot to apply the fix. See CVE-2026-31431 Kernel Upgrade Fix.

    A mitigation is available: Disable the AF_ALG protocol family.

    Mitigation for Alibaba Cloud Linux by Disabling the AF_ALG Protocol Family

    Updated images:

    • All public cloud images in the Alibaba Cloud Linux 2, 3, and 4 families, including Pro versions.

    Release plan:

    • Currently in a phased release. A full release is scheduled for May 15.

    Anolis OS

    7–8

    • Upgrade the kernel package and reboot to apply the fix.

    • Fixed kernel package versions:

      • 7: ≥4.19.91-28.5.an7

      • 8: ≥5.10.134-19.3.1.an8

    No mitigation announced by the community.

    In planning.

    Debian

    10–13

    • 11–13: A permanent fix is available. Upgrade the kernel package and reboot to apply the fix. See Debian-CVE-2026-31431.

    • 10: EOL. No permanent fix is available.

    No mitigation announced by the community.

    Updated images:

    • Debian 12.13/13.4 x64/arm64

    Release notes:

    Release plan:

    • Released on May 11. For release history, see: Debian

    Ubuntu

    18–24

    The community has not yet released a permanent fix.

    Community mitigation available:

    Updated images:

    • Ubuntu 22/24 x64/arm64

    Release notes:

    Release plan:

    • Released on May 11. For release history, see: Ubuntu

    Red Hat Enterprise Linux

    8–10

    • 8.10/9.7/10.1: A permanent fix is available. Upgrade the kernel package and reboot to apply the fix.

    • Fixed kernel package versions:

      • 8.10: ≥kernel-4.18.0-553.123.1.el8_10

      • 9.7: ≥kernel-5.14.0-611.54.1.el9_7

      • 10.1: ≥kernel-6.12.0-124.55.1.el10_1

    Community mitigation available

    No plans at this time.

    CentOS

    8

    EOL. No permanent fix is available.

    No mitigation announced by the community.

    No plans.

    CentOS Stream

    8–10

    The community has not yet released a permanent fix. A patch has been merged into the repository but has not been released as a package.

    No mitigation announced by the community.

    No plans at this time. Images will be updated once the community provides a fix.

    Rocky Linux

    8–10

    • 8.10/9.7/10.1: A permanent fix is available. Upgrade the kernel package and reboot to apply the fix.

    • Fixed kernel package versions:

      • 8.10: ≥kernel-4.18.0-553.123.1.el8_10

      • 9.7: ≥kernel-5.14.0-611.54.1.el9_7

      • 10.1: ≥kernel-6.12.0-124.55.1.el10_1

    No mitigation announced by the community.

    Updated images:

    • Rocky Linux 8.10/9.7/10.1 x64/arm64

    Release notes:

    Release plan:

    • Released on May 11. For release history, see: Rocky Linux

    AlmaLinux

    8–10

    • 8.10/9.7/10.1: A permanent fix is available. Upgrade the kernel package and reboot to apply the fix.

    • Fixed kernel package versions:

      • 8.10: ≥kernel-4.18.0-553.121.1.el8_10

      • 9.7: ≥kernel-5.14.0-611.49.2.el9_7

      • 10.1: ≥kernel-6.12.0-124.52.2.el10_1

    No mitigation announced by the community.

    Updated images:

    • AlmaLinux 8.10/9.7/10.1 x64/arm64

    Release notes:

    Release plan:

    • Released on May 11. For release history, see: AlmaLinux

    Fedora

    33–42

    • 33–41: EOL. No permanent fix is available.

    • 42: A permanent fix is available. Upgrade the kernel package and reboot to apply the fix. Fixed kernel package version:

      • ≥kernel-6.19.12-100.fc42

    No mitigation announced by the community.

    No plans.

    ECS does not currently offer any images for Fedora 42. Future Fedora 42 images will include the fix.

    SUSE Linux Enterprise Server

    12–16

    • SLES 15 SP7/SAP, 16.0/SAP: A permanent fix is available. Upgrade the kernel package and reboot to apply the fix.

    Community mitigation available

    In planning.

    openSUSE

    15–16

    • 15.6, 16.0: A permanent fix is available. Upgrade the kernel package and reboot to apply the fix.

    Community mitigation available

    In planning.

    Remediation for existing instances

    For most distributions, applying the permanent fix involves upgrading kernel-related packages and rebooting the system.

    Debian

    Debian 10

    Debian 10 is EOL. The project no longer provides a permanent fix.

    Upgrade to Debian 11, 12, or 13 before applying the fix.

    Debian 11–13

    Applies to:

    • Debian 11/12/13

    # The backports repository is deprecated. Comment out its configuration to prevent update errors (https://backports.debian.org/Instructions).
sudo sed -i '/bullseye-backports/s/^/#/' /etc/apt/sources.list

# Update repositories.
sudo apt update

# Upgrade the kernel (optional).
sudo apt install -y --only-upgrade linux-image-amd64

# Or upgrade all packages (recommended).
sudo apt upgrade -y

# Reboot to apply the changes.
sudo reboot

    Ubuntu

    Ubuntu currently provides only a mitigation. A permanent fix is not yet available.

    Applies to:

    • Ubuntu 22/24

    # Update packages.
sudo apt update && sudo apt upgrade

# Or upgrade only kmod.
sudo apt install --only-upgrade kmod

# Unload the algif_aead module.
sudo rmmod algif_aead 2>/dev/null

# If the module is in use, a reboot is required.
sudo reboot

    Red Hat Enterprise Linux

    Applies to:

    • RHEL 8.10/9.7/10.1

    # Upgrade the kernel.
sudo dnf update kernel

# Reboot to apply the changes.
sudo reboot

    Rocky Linux

    Applies to:

    • Rocky Linux 8.10/9.7/10.1

    # Clear and rebuild the repository cache.
sudo dnf clean all
sudo dnf makecache

# Update packages.
sudo dnf update

# Reboot to apply the changes.
sudo reboot

    AlmaLinux

    Applies to:

    • AlmaLinux 8.10/9.7/10.1

    # Clean the repository cache and upgrade packages.
sudo dnf clean metadata && sudo dnf upgrade

# Reboot to apply the changes.
sudo reboot

    SUSE Linux Enterprise Server

    Applies to:

    • SLES 15 SP7 / SAP

    • SLES 16.0 / SAP

    SLES 15 SP7 / SAP

    # Install the patch.
sudo zypper install -y -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-1673

# Reboot to apply the changes.
sudo reboot

    SLES 16.0 / SAP

    # Install the patch.
sudo zypper install -y -t patch SUSE-SLES-16.0-666

# Reboot to apply the changes.
sudo reboot

    openSUSE

    Applies to:

    • openSUSE 15.6/16.0

    openSUSE 15.6

    # Install the patch.
sudo zypper install -y -t patch openSUSE-SLE-15.6-2026-1671

# Reboot to apply the changes.
sudo reboot

    openSUSE 16.0

    # Install the patch.
sudo zypper install -y -t patch openSUSE-Leap-16.0-596

# Reboot to apply the changes.
sudo reboot