[CVE ] cve-2026_31431 possible mitigation via systemtap

[xili@redhat.com]

Hi Systemtap Team,

Good day.
I0„2notice that there is bpf version
0„2https://github.com/atgreen/block-copyfail0„2for the cve-2026_31431
mitigation; however, it seems that it cannot work for some kernel
version.
So i am trying to write a systemtap version which would do the similar
same for the OS which support systemtap.

systemtap scripts0„2
~~~
#!/usr/bin/stap -g
probe kernel.function("alg_bind").call {
if( $uaddr->sa_family == 38) {
msg=sprintf("%s alg_bind AF_ALG hit by %d:%s , kill
it\n",tz_ctime(gettimeofday_s()), pid(),execname())
printk(1, msg)
raise(9)
}
}
~~~

Quick test as below
~~~
1. execute the stap
# ./cve-2026_31431.stp 

2. try to root but failed (without0„2cve-2026_31431.stp, we can root
easily0„2)
$ ./copy-fail-root-demo
[+] target: /usr/bin/su
[+] payload: 1704 bytes (426 iterations)
Killed

3, from messages we can see logs0„2
Sat May 9 20:27:20 2026 CST alg_bind AF_ALG hit by 3340557:copy-fail-
root-demo0„2, kill it
~~~

Any comment would be appreciated.

Regards
Sam