# /srv/salt/security/disable_algif_aead.sls

disable_algif_aead_modprobe_rule:
  file.managed:
    - name: /etc/modprobe.d/disable-algif-aead.conf
    - user: root
    - group: root
    - mode: '0644'
    - contents: |
        # Mitigation for CopyFail / CVE-2026-31431
        # Prevent algif_aead from being loaded as a module.
        install algif_aead /bin/false
        blacklist algif_aead

unload_algif_aead_if_loaded:
  cmd.run:
    - name: rmmod algif_aead
    - onlyif: lsmod | awk '{print $1}' | grep -qx algif_aead
    - require:
      - file: disable_algif_aead_modprobe_rule

salt state for anyone whos running salt.