DocsICP FilingConsole
Documentation

CVE-2026-31431: Impact and remediation on official images

Updated at:
Copy as MD
Product
My Favorites

[Updated on September 24, 2026] This document outlines the impact of the CVE-2026-31431 (Copy Fail) security vulnerability on Alibaba Cloud ECS official Linux images, the image remediation plan, and how to fix existing instances. This document is continuously updated.

Impact scope, community status, and ECS remediation

Distribution

Affected versions

Permanent fix

Mitigation

ECS image status

Alibaba Cloud Linux

2–4

Upgrade the kernel package and reboot to apply the fix. See CVE-2026-31431 Kernel Upgrade Fix.

A mitigation is available: Disable the AF_ALG protocol family.

Mitigation for Alibaba Cloud Linux by Disabling the AF_ALG Protocol Family

  • All public cloud images in the Alibaba Cloud Linux 2, 3, and 4 families (including Pro): fix released

Anolis OS

7–8

  • Upgrade the kernel package and reboot to apply the fix.

  • Fixed kernel package versions:

    • 7: ≥4.19.91-28.5.an7

    • 8: ≥5.10.134-19.3.1.an8

No mitigation announced by the community.

Updated image scope:

  • 8.10 ANCK/RHCK

Release plan:

  • Fix released

Debian

10–13

  • 11–13: A permanent fix is available. Upgrade the kernel package and reboot to apply the fix. See Debian-CVE-2026-31431.

  • Fixed linux-image versions:

    • 11: ≥linux-image-5.10.0-41-amd64

    • 12: ≥linux-image-6.1.0-45-amd64

    • 13: ≥linux-image-6.12.85+deb13-amd64

  • 10: EOL. No permanent fix is available.

No mitigation announced by the community.

  • 12.13/13.4: fix released in May 2026

  • 11.11: fix released in June 2026

Release history: Debian

Ubuntu

18–24

  • Fixed kernel packages have been released: https://ubuntu.com/security/CVE-2026-31431

  • Fixed kernel package versions:

    • 24: ≥linux-image-6.8.0-117-generic

    • 22: ≥linux-image-5.15.0-179-generic

  • 18/20: ELS. Fixes are provided for Pro versions only.

Community mitigation available:

  • Fix released (permanent fix) in late May 2026.

Release history: Ubuntu

Red Hat Enterprise Linux

8–10

  • 8.10/9.7/10.1: A permanent fix is available. Upgrade the kernel package and reboot to apply the fix.

  • Fixed kernel package versions:

    • 8.10: ≥kernel-4.18.0-553.123.1.el8_10

    • 9.7: ≥kernel-5.14.0-611.54.1.el9_7

    • 10.1: ≥kernel-6.12.0-124.55.1.el10_1

Community mitigation available

No plans. The fix will be included in the 10.2 and 9.8 images.

CentOS

8

EOL. No permanent fix is available.

No mitigation announced by the community.

No plans.

CentOS Stream

8–10

  • 9/10: Fixed

No mitigation announced by the community.

  • CentOS Stream 9/10: fix released in June 2026

Release history: CentOS Stream

Rocky Linux

8–10

  • 8.10/9.7/10.1: A permanent fix is available. Upgrade the kernel package and reboot to apply the fix.

  • Fixed kernel package versions:

    • 8.10: ≥kernel-4.18.0-553.123.1.el8_10

    • 9.7: ≥kernel-5.14.0-611.54.1.el9_7

    • 10.1: ≥kernel-6.12.0-124.55.1.el10_1

No mitigation announced by the community.

  • Rocky Linux 8.10/9.7/10.1: fix released in May 2026

Release history: Rocky Linux

AlmaLinux

8–10

  • 8.10/9.7/10.1: A permanent fix is available. Upgrade the kernel package and reboot to apply the fix.

  • Fixed kernel package versions:

    • 8.10: ≥kernel-4.18.0-553.121.1.el8_10

    • 9.7: ≥kernel-5.14.0-611.49.2.el9_7

    • 10.1: ≥kernel-6.12.0-124.52.2.el10_1

No mitigation announced by the community.

  • AlmaLinux 8.10/9.7/10.1: fix released in May 2026

Release history: AlmaLinux

Fedora

33–42

  • 33–41: EOL. No permanent fix is available.

  • 42: A permanent fix is available. Upgrade the kernel package and reboot to apply the fix. Fixed kernel package version:

    • ≥kernel-6.19.12-100.fc42

No mitigation announced by the community.

No plans.

ECS does not currently offer any images for Fedora 42. Future Fedora 43 and 44 images will include the permanent fix.

SUSE Linux Enterprise Server

12–16

  • SLES 15 SP7/SAP, 16.0/SAP: A permanent fix is available. Upgrade the kernel package and reboot to apply the fix.

Community mitigation available

  • SLES 16.0 (including SAP): fix released in July 2026

  • SLES 15 SP7 (including SAP): fix released in July 2026

openSUSE

15–16

  • 15.6, 16.0: A permanent fix is available. Upgrade the kernel package and reboot to apply the fix.

Community mitigation available

  • openSUSE 15.6/16.0: fix released in May 2026

Release history: openSUSE

Remediation for existing instances

For most distributions, applying the permanent fix involves upgrading kernel-related packages and rebooting the system.

Debian

Debian 10

Debian 10 is EOL. The project no longer provides a permanent fix.

Upgrade to Debian 11, 12, or 13 before applying the fix.

Debian 11–13

Applies to:

  • Debian 11/12/13

# The backports repository is deprecated. Comment out its configuration to prevent update errors (https://backports.debian.org/Instructions).
sudo sed -i '/bullseye-backports/s/^/#/' /etc/apt/sources.list

# Update repositories.
sudo apt update

# Upgrade the kernel (optional).
sudo apt install -y --only-upgrade linux-image-amd64

# Or upgrade all packages (recommended).
sudo apt upgrade -y

# Reboot to apply the changes.
sudo reboot

Ubuntu

  • Applies to: Ubuntu 22.04 and Ubuntu 24.04

  • Reference: Upgrade the kernel of a Linux instance

    • Ubuntu 24.04 kernel package version ≥6.8.0-117-generic

    • Ubuntu 22.04 kernel package version ≥5.15.0-179-generic

Red Hat Enterprise Linux

Applies to:

  • RHEL 8.10/9.7/10.1

# Upgrade the kernel.
sudo dnf update kernel

# Reboot to apply the changes.
sudo reboot

CentOS

CentOS 8 is EOL. No permanent fix is available.

CentOS Stream

The CentOS Stream community has not yet released a fix.

Rocky Linux

Applies to:

  • Rocky Linux 8.10/9.7/10.1

# Clear and rebuild the repository cache.
sudo dnf clean all
sudo dnf makecache

# Update packages.
sudo dnf update

# Reboot to apply the changes.
sudo reboot

AlmaLinux

Applies to:

  • AlmaLinux 8.10/9.7/10.1

# Clean the repository cache and upgrade packages.
sudo dnf clean metadata && sudo dnf upgrade

# Reboot to apply the changes.
sudo reboot

Fedora

  • Fedora 33–41 images on ECS are EOL. No fix is planned.

  • Fedora 42–44 images are not yet available on ECS.

SUSE Linux Enterprise Server

Applies to:

  • SLES 15 SP7 / SAP

  • SLES 16.0 / SAP

SLES 15 SP7 / SAP

# Install the patch.
sudo zypper install -y -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-1673

# Reboot to apply the changes.
sudo reboot

SLES 16.0 / SAP

# Install the patch.
sudo zypper install -y -t patch SUSE-SLES-16.0-666

# Reboot to apply the changes.
sudo reboot

openSUSE

Applies to:

  • openSUSE 15.6/16.0

openSUSE 15.6

# Install the patch.
sudo zypper install -y -t patch openSUSE-SLE-15.6-2026-1671

# Reboot to apply the changes.
sudo reboot

openSUSE 16.0

# Install the patch.
sudo zypper install -y -t patch openSUSE-Leap-16.0-596

# Reboot to apply the changes.
sudo reboot