Patch Me If You Can | LINUX Unplugged 665

We dig into the Copy Fail vulnerability and test a proof-of-concept against our own box. Plus, Jon Seager, VP of Engineering at Canonical joins us, and we kick off the BSD Challenge!
Sponsored By:
• Jupiter Party Annual Membership (jupitersignal.memberful.com/checkout?plan=1176…): Put your support on automatic with our annual plan, and get one month of membership for free! (jupitersignal.memberful.com/checkout?plan=1176…)
• Managed Nebula (defined.net/unplugged): Meet Managed Nebula from Defined Networking. A decentralized VPN built on the open-source Nebula platform that we love. (defined.net/unplugged)
Support LINUX Unplugged (jupitersignal.memberful.com/checkout?plan=52946)
Links:
• 💥 Gets Sats Quick and Easy with Strike (strike.me)
• 📻 LINUX Unplugged on Fountain.FM (fountain.fm/show/dWiuBeqpDSM86AwXRXov)
• Copy Fail — CVE-2026-31431 (copy.fail/#exploit) — "An unprivileged local user can write four controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root." — Theori
• Copy Fail: 732 Bytes to Root - Xint (xint.io/blog/copy-fail-linux-distributions) — "A single 732-byte Python script can edit a setuid binary and obtain root on essentially all Linux distributions shipped since 2017." — Xint
• Linux Kernel Bug Explained - Jorijn (jorijn.com/en/blog/copy-fail-cve-2026-31431-li…) — "CopyFail is more portable. One script, every distro, no offsets. Dirty Pipe needed kernel ≥ 5.8; Copy Fail covers 2017–2026." — Jorijn"Kubernetes Pod Security Standards (Restricted) and default seccomp do NOT block the syscall used." — Jorijn
• Ars: Most Severe Linux Threat in Years (arstechnica.com/security/2026/04/as-the-most-s…) — "The most severe Linux threat to surface in years catches the world flat-footed." — Ars Technica
• Sysdig: CVE-2026-31431 Analysis (sysdig.com/blog/cve-2026-31431-copy-fail-linux…) — "The flaw was introduced in 2017 via commit 72548b093ee3, which switched AEAD operations to in-place processing." — Sysdig
• CERT-EU Advisory (cert.europa.eu/publications/security-advisorie…)
• Ubuntu Security Tracker (ubuntu.com/security/CVE-2026-31431)
• The Register: Crypto Flaw (theregister.com/2026/04/30/linux_cryptographic…)
• Kernel Patch (reverts 2017 optimization) (github.com/torvalds/linux/commit/a664bf3d603dc…) — "This mostly reverts commit 72548b093ee3 except for the copying of the associated data." — Kernel Commit
• Buggy Commit: 72548b093ee3 (2017) (github.com/torvalds/linux/commit/72548b093ee3)
• DeepWiki: AF_ALG Internals (deepwiki.com/theori-io/copy-fail-CVE-2026-3143…)-internals)
• oss-security Disclosure (openwall.com/lists/oss-security/2026/04/29/23)
• PSA + GRUB Mitigation - Jan Wildeboer (jan.wildeboer.net/2026/05/PSA-CopyFail-CVE-202…)
• Ubuntu 26.04 LTS (Resolute Raccoon) Released (canonical.com/blog/canonical-releases-ubuntu-2…) — "Ubuntu 26.04 LTS sets the example for providing best-in-class resilience while simultaneously embracing innovation and the advancement of open source." — Jon Seager, VP Ubuntu Engineering
• The Future of AI in Ubuntu - Jon Seager (discourse.ubuntu.com/t/the-future-of-ai-in-ubu…) — "Throughout 2026 we'll be working on enabling access to frontier AI for Ubuntu users in a way that is deliberate, secure, and aligned with our open source values." — Jon Seager
• Ubuntu 26.04 Release Notes (documentation.ubuntu.com/release-notes/26.04)
• Ubuntu AI Features Throughout 2026 - Phoronix (phoronix.com/news/Ubuntu-AI-Features-2026) — "Canonical's approach to AI is refreshingly thoughtful — Microsoft should take note." — ZDNet
• Canonical DDoS Attack Update (discourse.ubuntu.com/t/update-concerning-ddos-…) — "Canonical's web infrastructure is under a sustained, cross-border attack and we are working to address it." — arcticp, Canonical
• Ubuntu Weekly Newsletter #942 (discourse.ubuntu.com/t/ubuntu-weekly-newslette…)
• Canonical AI Approach - ZDNet (zdnet.com/article/canonical-ai-approach-though…)
• 9to5Linux: Opt-In LLM Tools (9to5linux.com/canonical-plans-to-integrate-opt…)
• uutils/coreutils: Cross-platform Rust rewrite of the GNU coreutils (github.com/uutils/coreutils)
• LINUX Unplugged 636: Engineering the Future (linuxunplugged.com/636)
• LiveCD fails to start X session on QEMU · Issue #354 · ghostbsd/issues (github.com/ghostbsd/issues/issues/354)
• Monty's “rescue” drive NixOS config (github.com/pmontgo33/nix-config)
• Magnolia Mayhem's BSD Challenge Report (ministryofmayhem.space/posts/bsdptdeux)
• Pick: NASty (github.com/nasty-project/nasty) — NASty is a NAS operating system built on NixOS and bcachefs. It turns commodity hardware into a storage appliance serving NFS, SMB, iSCSI, and NVMe-oF — managed from a single web UI, updated atomically, and rolled back when things go sideways.
• Pick: Defuse (github.com/shonebinu/Defuse) — Defuse is a GTK4 application for removing image backgrounds locally.
• Defuse on Flathub (flathub.org/en/apps/io.github.shonebinu.Defuse)