Looking for an official CVE-2026-31431/Copy Fail answer

All supported NS8 distributions now have a kernel patched against CVE-2026-31431 available.

The official patched kernel 5.14.0-611.54.1.el9_7.x86_64 released by Rocky Linux is available from the NS8 repositories as well.

The remediation procedure is:

  1. (Rocky Linux 9 users only) revert the previous mitigation
  2. apply the base OS updates[1]
  3. reboot the system
  4. check that the running kernel release matches your distribution patch level (for example, compare the output of uname -r with the installed kernel package version)

Older versions, NS7 and NS6, are not affected.

Revert the Rocky Linux 9 mitigation

If you applied the Rocky Linux mitigation procedure[2], which adds a kernel boot parameter, it is now safe to remove it.

Review the kernel parameter list with:

grep ^GRUB_CMDLINE_LINUX /etc/default/grub

Remove the mitigation parameter with:

grubby --update-kernel=ALL --remove-args="initcall_blacklist=algif_aead_init"

Note that removing the parameter makes non-patched kernels vulnerable again.


  1. https://docs.nethserver.org/projects/ns8/en/latest/os_updates.html ↩︎

  2. https://kb.ciq.com/article/rocky-linux/rl-cve-2026-31431-mitigation ↩︎

3 Likes

Just to double check, I thought only Rocky Linux based systems are officially supported? All other Linux flavors are not officially supported and are ‘It may work but use at your own risk’?

Rocky Linux is needed for subscription support, some other distros are supported by community, see System requirements — NS8 documentation

If you want, sooner or later, have access to paid support (subscription), yes.
Otherwise, the link @mrmarkuz provided above contain supported distros that currently are not answered “We won’t help you in any way” into this community.

1 Like

That is a bit frustrating, for Nethesis states that the community supports the other distro’s. I believe it is not up to Nethesis to state that, but ‘use your distro of choice at your own risk, and feel free to ask questions on the forums, but no guarantees to get an answer for it is best effort based’. e.g. see many unswered questions. The forums are not the same as ‘a community’, hence my post on ‘the fun is gone’. There are virtually only technical questions on the forums. Nothing to do with community anymore.

This does NOT mean I personally do not appreciate and recognise all the efforts from Nethesis staff individually. I very much do so, but every time a ‘sensitive topic’ is touched, the nervous vibes start kicking in.

And do not take it personally, I am talking about the role, the ‘community manager’ role is obsolete. Many Nethesis staff (off and on) are acting as a liason bewteen forum users and Nethesis, and that works in this moment in time, but not even try to managing a community.

It seems that for every non technical issue, an extra alinea is added to some paperwork to validate and avoid any meaningfull conversation or interaction with forum users.

So the community is dead, long live the support forums.

Really?

Please do NOT follow this ‘suggestion’.

Here we go

ça va sans dire…
Better verify the sanity and the safety of this shell script before consider to use it in any production system

I read the manual sentence “Linux distributions and versions with NethServer community support” as meaning “you can find support for those distributions in the NethServer community”, and this forum is where that community meets.

I agree that the presence and quality of community support depends on volunteers’ work and personal commitment, and that this may change over time. So we can probably improve that sentence to make the distinction clearer. For example: “NS8 is also compatible with Debian and EL clone distributions, and you may find support in the community forum”.

There are many ways to contribute. Everyone can jump in and donate their 2 cents: it is a personal choice.

I think the community manager role changes as the community evolves over time, but what always matters is the quality of the posts. Every single word written here remains and helps shape the community. In the end, we are the authors of this story, not only the community manager.

Nethesis and RedHat have both confirmed that NS7 (or CentOS7, on which it’s based) are unaffected by this vuln, so there’s no apparent reason to be running random shell scripts to “confirm” what’s already known.

1 Like