No-reboot BPF LSM mitigation for Copy Fail / CVE-2026-31431

I put together a small host-level mitigation for Copy Fail / CVE-2026-31431 for cases where you need to reduce exposure before you can roll out patched kernels or livepatches:

https://github.com/pizzasuprema/copyfail-bpf-guard

It installs a BPF LSM program that denies AF_ALG binds where salg_type == "aead". The goal is to block the vulnerable algif_aead userspace crypto path without rebooting and without blocking all normal sockets or non-AEAD AF_ALG uses.

This is meant for the awkward middle ground where:

• algif_aead is built into the kernel, so module unload/blacklist is not enough
• rebooting a fleet immediately is disruptive
• building per-kernel kpatch/livepatch modules is not practical yet
• BPF LSM is enabled and active on the host

It is not a kernel fix. It does not patch the vulnerable code, and it should be replaced by vendor kernel errata, vendor livepatch, or a maintained kpatch when available.

Basic use:

./copyfail-bpf-guard.sh check
sudo ./copyfail-bpf-guard.sh install-deps
sudo ./copyfail-bpf-guard.sh install
./copyfail-bpf-guard.sh probe

The default install uses an embedded checksum-verified BPF object, so target hosts only need bpftool; clang/llvm are only needed if rebuilding the object from source.

Feedback welcome, especially from folks running mixed bare-metal/VM fleets where Kubernetes-only DaemonSet mitigations or module blacklists do not cover the whole problem.