# \[CVE-2026-31431\] IMPORTANT: upgrade your system package
**URL:** https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171
**Category:** Security
**Created:** [May 1, 2026, 10:07pm UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171 "2026-05-01T22:07:28Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@YunoHost](https://forum.yunohost.org/u/YunoHost)
#### Post date: [May 1, 2026, 10:07pm UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/1 "2026-05-01T22:07:29Z")
Hi,
Yesterday has been published an exploit which allows to make priviledge escalation from a non root user on every Linux installed since 2017. The exploit has been assigned number CVE-2026-31431, and nicknamed Copy Fail.
A fix is now available for Debian 12 and 13, onto which YunoHost 12 and (testing) 13 are based. **We highly recommend to upgrade** your **system** packages, for example, from the web admin ASAP. You should get an update for a `linux-image-...` package.
⚠ Raspberry Pi users, or probably users with hardware that requires a specific kernel build, check your provider’s usual software release channels for information about CVE-2026-31431.
**After the upgrade you must reboot. If you don’t reboot, the old linux kernel could stay in use.**
You should do it very quickly:
- if you don’t trust your yunohost users (especially with apps that allow users to run their own shells or scripts, like JupyterLab)
- apps which have regularly security problem giving access to a standard user like (e.g. some CMS like WordPress, unmaintained upstream).
- if you have given some ssh permission to standard user or if you have set easy password on some account (and you miss to change it 😕 )
[CVE-2026-31431](https://security-tracker.debian.org/tracker/CVE-2026-31431)
---
### Author:  [@arnauld](https://forum.yunohost.org/u/arnauld)
#### Post date: [May 2, 2026, 9:34am UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/2 "2026-05-02T09:34:09Z")
Hum, I don’t have any updates proposed…
---
### Author:  [@arnauld](https://forum.yunohost.org/u/arnauld)
#### Post date: [May 2, 2026, 9:36am UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/3 "2026-05-02T09:36:53Z")
Is it those upgrades:
> dovecot-core dovecot-imapd dovecot-ldap dovecot-lmtpd dovecot-managesieved
>
> - dovecot-sieve
---
### Author:  [@tituspijean](https://forum.yunohost.org/u/tituspijean)
#### Post date: [May 2, 2026, 9:56am UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/4 "2026-05-02T09:56:22Z")
No, you should see an upgrade for `linux-image-...`.
Can you check two things?
1. the output of `uname -a`
2. the contens of `/etc/apt/sources.list` should have a line with `deb http://security.debian.org/ bookworm-security ...`
---
### Author:  [@Lanky](https://forum.yunohost.org/u/Lanky)
#### Post date: [May 2, 2026, 10:05am UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/5 "2026-05-02T10:05:31Z")
Same for me, I don’t have any upgrade for now.
- uname -v results to `#1 SMP PREEMPT Debian 1:6.12.47-1+rpt1~bookworm (2025-09-16)`
- and the contents of `/etc/apt/sources.list `
---
### Author:  [@Kit](https://forum.yunohost.org/u/Kit)
#### Post date: [May 2, 2026, 11:59am UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/7 "2026-05-02T11:59:59Z")
Check if you have` unattended-upgrades` package installed
---
### Author:  [@Vinz](https://forum.yunohost.org/u/Vinz)
#### Post date: [May 2, 2026, 12:03pm UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/8 "2026-05-02T12:03:48Z")
Hello and thanks for the warning about copy fail.
Is the listing above in sources.list valid for all architectures? I am running on a Raspeberry Pi and it looks like this is managed by them and not directly by Debian right?
```auto
$ cat sources.list
deb http://raspbian.raspberrypi.org/raspbian/ bookworm main contrib non-free non-free-firmware rpi
# Uncomment line below then 'apt-get update' to enable 'apt-get source'
#deb-src http://raspbian.raspberrypi.org/raspbian/ bookworm main contrib non-free non-free-firmware rpi
```
and also
```auto
$ ls sources.list.d/
extra_php_version.list raspi.list yarn.list yunohost.list
$ cat sources.list.d/raspi.list
deb http://archive.raspberrypi.org/debian/ bookworm main
# Uncomment line below then 'apt-get update' to enable 'apt-get source'
#deb-src http://archive.raspberrypi.org/debian/ bookworm main
```
So I am wondering if this needs to be updated on the R-Pi foundation first …
Thanks for your help !
Vincent
PS: version info
```auto
$ sudo yunohost --version
yunohost:
repo: stable
version: 12.1.39
yunohost-admin:
repo: stable
version: 12.1.14
yunohost-portal:
repo: stable
version: 12.1.2
moulinette:
repo: stable
version: 12.1.3
ssowat:
repo: stable
version: 12.1.1
```
---
### Author:  [@PechGehabt](https://forum.yunohost.org/u/PechGehabt)
#### Post date: [May 2, 2026, 12:13pm UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/9 "2026-05-02T12:13:37Z")
Don’t see any update hint. I am on [YunoHost](https://yunohost.org/) 12.1.39 (stable). Also see no new release here: [Releases · YunoHost/yunohost · GitHub](https://github.com/YunoHost/yunohost/releases)
---
### Author:  [@pipoTux](https://forum.yunohost.org/u/pipoTux)
#### Post date: [May 2, 2026, 1:09pm UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/10 "2026-05-02T13:09:23Z")
Hello all,
in the case of Raspberry Pi, the update hasn’t been released yet, but in the meantime, you can follow the instructions provided here:
[https://forums.raspberrypi.com/viewtopic.php?t=397946](https://forums.raspberrypi.com/viewtopic.php?t=397946)
> **[High Vulnerability in the Linux Kernel ("Copy Fail")](https://cert.europa.eu/publications/security-advisories/2026-005/)**
>
> High Vulnerability in the Linux Kernel ("Copy Fail")
```auto
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true
```
---
### Author:  [@tituspijean](https://forum.yunohost.org/u/tituspijean)
#### Post date: [May 2, 2026, 4:35pm UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/11 "2026-05-02T16:35:57Z")
First post updated with Raspberry Pi information. It looks like indeed the updated kernel is not released yet.
* * *
> [@PechGehabt](#):
>
> Don’t see any update hint. I am on [YunoHost](https://yunohost.org/) 12.1.39 (stable). Also see no new release here: [Releases · YunoHost/yunohost · GitHub](https://github.com/YunoHost/yunohost/releases)
There was no need to change anything in YunoHost’s code. However, you should get a kernel update at some point.
---
### Author:  [@PechGehabt](https://forum.yunohost.org/u/PechGehabt)
#### Post date: [May 2, 2026, 5:06pm UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/12 "2026-05-02T17:06:46Z")
Thanks! One question:
> you should get a kernel update at some point
You mean via Yunohost Backend - correct?
---
### Author:  [@tituspijean](https://forum.yunohost.org/u/tituspijean)
#### Post date: [May 3, 2026, 9:21am UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/13 "2026-05-03T09:21:04Z")
No, from Debian repositories, or Raspbian’s if you have a Raspberry Pi. The fix for that CVE does not come from YunoHost but from the Linux kernel developers. (but now that I read again the first post, I can understand where that confusion comes from, I’ll rephrase it.)
---
### Author:  [@PechGehabt](https://forum.yunohost.org/u/PechGehabt)
#### Post date: [May 3, 2026, 9:51am UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/14 "2026-05-03T09:51:23Z")
Hi! Thanks a lot! I had unattended upgrades activated and only needed to reboot. Thanks!
---
### Author:  [@mobi0001](https://forum.yunohost.org/u/mobi0001)
#### Post date: [May 5, 2026, 4:20pm UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/15 "2026-05-05T16:20:12Z")
Ideally run these regularly:
`apt-get update && apt-get upgrade -y`
Also, make sure you have the security repo added to your `/etc/apt/sources.list` file.
`deb-src http://security.debian.org/debian-security bookworm-security main non-free-firmware`
---
### Author:  [@Pinipon](https://forum.yunohost.org/u/Pinipon)
#### Post date: [May 6, 2026, 6:50am UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/16 "2026-05-06T06:50:36Z")
There’s no need to ssh and do that, it can be done through the “update” section in webadmin, or using unattended upgrades.
---
### Author:  [@arnauld](https://forum.yunohost.org/u/arnauld)
#### Post date: [May 14, 2026, 10:44am UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/17 "2026-05-14T10:44:22Z")
Hi,
I have those updates this morning for my Pi 5, do they patch the exploit ?:
> linux-headers-rpi-2712 from 1:6.12.75-1+rpt1~bookworm to 1:6.12.87-1+rpt1~bookworm
> linux-headers-rpi-v8 from 1:6.12.75-1+rpt1~bookworm to 1:6.12.87-1+rpt1~bookworm
> linux-image-rpi-2712 from 1:6.12.75-1+rpt1~bookworm to 1:6.12.87-1+rpt1~bookworm
> linux-image-rpi-v8 from 1:6.12.75-1+rpt1~bookworm to 1:6.12.87-1+rpt1~bookworm
>
> libnghttp2-14 from 1.52.0-1+deb12u2 to 1.52.0-1+deb12u3
> linux-libc-dev from 1:6.12.75-1+rpt1~bookworm to 1:6.12.87-1+rpt1~bookworm
> raspi-firmware from 1:1.20250915-1~bookworm to 1:1.20260513-1~bookworm
---
### Author:  [@marco](https://forum.yunohost.org/u/marco)
#### Post date: [May 15, 2026, 7:56am UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/18 "2026-05-15T07:56:09Z")
Hi,
the lastest info for RPi I found is there : [https://forums.raspberrypi.com/viewtopic.php?t=397946&start=75#p2375558](https://forums.raspberrypi.com/viewtopic.php?t=397946&start=75#p2375558)
It seems, you can test your system regarding CopyFail (cve-2026-31431) using this python script : [cve\_2026\_31431/test\_cve\_2026\_31431.py at main · rootsecdev/cve\_2026\_31431 · GitHub](https://github.com/rootsecdev/cve_2026_31431/blob/main/test_cve_2026_31431.py)
---
### Author:  [@marco](https://forum.yunohost.org/u/marco)
#### Post date: [May 23, 2026, 1:42pm UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/19 "2026-05-23T13:42:46Z")
On my side (RPi 3B+), after updates and reboot, uname -r returns:
6.12.20-v7+
which is vulnerable to both CVE-2026-31431 and CVE-2026-43284 😪
despite the news I read here: [https://forums.raspberrypi.com/viewtopic.php?t=397946&start=75#p2375558](https://forums.raspberrypi.com/viewtopic.php?t=397946&start=75#p2375558)
waiting for 6.12.87…
---
### Author:  [@BrunoK](https://forum.yunohost.org/u/BrunoK)
#### Post date: [May 23, 2026, 7:55pm UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/20 "2026-05-23T19:55:26Z")
I got the warning form diagnostics to update the kenrel.
in my case, the system was updated allright, but not rebooted.
YH-Diagnostics said to upgrade the kernel (but didn’t mention the necessity to reboot, that would have helped me)
---
### Author:  [@marco](https://forum.yunohost.org/u/marco)
#### Post date: [May 23, 2026, 10:15pm UTC](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171/21 "2026-05-23T22:15:46Z")
@BrunoK you might not have noticed, but this information is mentioned all over the forum – for example, at the top of this page in bold.
In the event of a major vulnerability, I think that’s good practice to check the forum for updates.
[Next page](https://forum.yunohost.org/t/cve-2026-31431-important-upgrade-your-system-package/42171.md?page=2)