Linux “Copy Fail” Vulnerability (CVE-2026-31431): Actions Taken by BoxToPlay and Guidance for VPS Users

A new Linux kernel vulnerability, CVE-2026-31431, also known as “Copy Fail”, has been disclosed. It is a local privilege escalation issue in the cryptographic interface AF_ALG, specifically in the algif_aead module.

In concrete terms, this vulnerability can allow a non-root local user, already able to run code or commands on the machine, to potentially obtain root privileges.

It is very important to clarify that this is not a vulnerability that lets someone log into your server remotely just because you have an open SSH, web, or game server port. An attacker must already have a way to execute code locally or run commands on the system (for example through a compromised web application, a malicious script, or stolen credentials).

The risk is higher on multi-user environments, such as:

shared or mutualised servers
machines running third‑party code (plugins, scripts, bots, etc.)
container environments (Docker/LXC)
game servers with unverified extensions
panels or web apps that can execute system commands
VPS servers used by several users or exposed to untrusted code

Measures already implemented by BoxToPlay

Across our managed infrastructure (game nodes, internal services, panels and systems handled directly by our team), we have deployed a temporary mitigation against CVE-2026-31431.

In practice, we have:

blocked loading of the algif_aead kernel module
verified that it is not present in memory on our machines
started active monitoring of patched Linux kernels released by distributions

Our Minecraft nodes and other infrastructures directly administered by BoxToPlay are already protected by this mitigation. As soon as stable, fixed Linux kernels are made available by distributions, we will schedule and apply the final updates, including controlled reboots if needed.

This mitigation does not alter the services we operate day to day and serves only as an intermediate protection layer while we prepare for full kernel updates.

What this means for VPS customers

BoxToPlay VPS servers are isolated environments where internal management (system, packages, security inside the VPS) is under the customer’s responsibility.

We cannot automatically intervene inside your VPS (install packages, change configuration, reboot) without your explicit consent and access.

If you are running a Linux VPS, we strongly recommend that you:

apply the temporary mitigation yourself, or
update your Linux kernel as soon as a fixed version is available from your distribution

The following guidance targets Debian / Ubuntu systems.

Applying the temporary mitigation (Ubuntu / Debian)

The goal is to prevent the algif_aead module from loading and to ensure it is no longer present in memory.

Create a configuration file to disable algif_aead.
Unload the module if it is already loaded.
Check that it no longer appears in the module list.

Example session (output is illustrative):

root@demo-vps:~# sudo sh -c 'printf "install algif_aead /bin/false\nblacklist algif_aead\n" > /etc/modprobe.d/disable-algif.conf'
root@demo-vps:~# sudo rmmod algif_aead 2>/dev/null || true
root@demo-vps:~# lsmod | grep algif_aead
root@demo-vps:~# _

How to read this:

If lsmod | grep algif_aead returns nothing, the mitigation is active.
If algif_aead still appears in the lsmod output, we recommend rebooting the VPS after creating /etc/modprobe.d/disable-algif.conf, then checking again.

Under normal conditions, this mitigation should not affect common usages such as:

SSH connections
using sudo
running applications like Java
web services such as Apache or Nginx
databases like MySQL or similar services

It may impact very specific applications that use the AF_ALG crypto interface directly, which is uncommon for typical VPS hosting scenarios.

Installing the permanent fix (kernel update)

The definitive fix is to install a patched Linux kernel provided by your distribution and then reboot your VPS so it boots into this new kernel.

On Debian / Ubuntu, a common procedure can look like this (abridged example output):

root@demo-vps:~# sudo apt update
Get:1 http://... focal InRelease [265 kB]
Get:2 http://... focal-updates InRelease [120 kB]
...
Reading package lists... Done

root@demo-vps:~# sudo apt full-upgrade
Reading package lists... Done
Building dependency tree
...
The following packages will be upgraded:
  linux-image-generic linux-headers-generic ...
Do you want to continue? [Y/n] y
...

root@demo-vps:~# sudo reboot
Connection to demo-vps closed by remote host.
Connection to demo-vps closed.

Key points:

install the updates offered by your distribution, especially linux-image / linux-headers packages if a new kernel is available
a VPS reboot is required after installing a fixed kernel for it to actually be used

We encourage you to check your distribution’s documentation for the current status of fixes and to schedule the reboot at a time that fits your activity.

Need help?

Our team remains fully engaged on this topic and will continue to track Linux kernel fixes so we can keep our infrastructure up to date.

If you have a BoxToPlay VPS and are unsure about the right steps to take, or if you have questions about the potential impact in your specific case, you can open a support ticket from your panel. We will help you step by step to verify the mitigation, plan the kernel update, or review a more complex setup.

At BoxToPlay, we place strong emphasis on the reliability and security of your VPS hosting.

If you want to launch new projects on a solid foundation, you can try our VPS hosting with powerful resources for your applications: Start your free trial.

Join the Discussion