From 1859d8424e5844960216ef7948be46d2e0b5048a Mon Sep 17 00:00:00 2001
From: Raphael Dannecker <raphael.dannecker@steinbeisschule-reutlingen.de>
Date: Wed, 6 May 2026 06:55:45 +0200
Subject: [PATCH] Fix for CVE-2026-31431 https://copy.fail/

---
 roles/lmn_tmpfixes/tasks/main.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/roles/lmn_tmpfixes/tasks/main.yml b/roles/lmn_tmpfixes/tasks/main.yml
index 450d988..f39f9fd 100644
--- a/roles/lmn_tmpfixes/tasks/main.yml
+++ b/roles/lmn_tmpfixes/tasks/main.yml
@@ -33,5 +33,18 @@
     purge: true
     autoremove: true
 
+# CVE-2026-31431 https://copy.fail/#mitigation
+- name: Create modprobe config to disable algif_aead
+  ansible.builtin.lineinfile:
+    path: /etc/modprobe.d/disable-algif.conf
+    line: "install algif_aead /bin/false"
+    create: true
+    mode: '0644'
+
+- name: Remove algif_aead module if loaded
+  community.general.modprobe:
+    name: algif_aead
+    state: absent
+
 - name: Set VM permissions
   ansible.builtin.command: chmod -R o+r /lmn/vm