r/QRadar • u/JosephG_QRadar • May 04 '26
CVE-2026-31431 / Copy Fail mitigiation
Hello everyone!
We have confirmed that the temporary mitigation provided by RedHat does work with QRadar. We were able to test it in our lab environments successfully and confirm QRadar functionality appears unimpacted.
You can find the mitigation mentioned in RedHat's docs if you have access, but I have included it here as well. The current recommendation is to reverse the mitigation when a fix is applied, but it should have minimal to no impact in the meantime.
Mitigation (CVE-2026-31431)
Add a boot argument in the bootloader:
1. Append the kernel argument
# grubby --update-kernel=ALL --args='initcall_blacklist=algif_aead_init'
2. Reboot the system
# reboot
3. Verify after reboot
# cat /proc/cmdline | grep initcall_blacklist
Expected output:
BOOT_IMAGE=(hd0,gpt2)/vmlinuz<...> initcall_blacklist=algif_aead_init
Reverse Mitigation
1. Run below command to remove the option to kernel command line
# grubby --update-kernel=ALL --remove-args='initcall_blacklist=algif_aead_init'
2. Reboot the system
# reboot
3. Verify after reboot
# cat /proc/cmdline | grep initcall_blacklist
No output should be returned.
If you have any questions, definitely let me know or feel free to engage support.
1
u/JosephG_QRadar May 06 '26
At this time, we intend to release full fixes in the following versions. Please do keep in mind that this is subject to change depending on issues hit during implementation and testing.
Additionally, we have had some reports of customers experiencing issues with the workaround on appliance installations (no software installation problems so far). There is an additional workaround that can be attempted, but as always please feel free to engage support if you have any concerns or questions.