All Determinate Secure Packages distributions have the applicable patches.

The following kernel releases do not have the vulnerability:

• 6.18.24 and later
• 6.19.12 and later
• 7.0 and later
• Additionally, we have applied the patch to 6.12.81

Patched kernels are now available in Determinate Secure Packages:
* Determinate Secure Packages 25.11, v0.1.911988: inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-25.11/0.1";
* Determinate Secure Packages Rolling, v0.1.980628: inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling/0.1";

We are still building and testing the update for Determinate Secure Packages Rolling (FIPS).

NixOS users who do not depend on the algif_aead kernel module can disable it via:

boot.extraModprobeConfig = ''
install algif_aead ${pkgs.busybox}/bin/false
'';

followed by running rmmod algif_aead 2>/dev/null || true.

NixOS users can also disable the kernel module temporarily without a deployment via:

echo "install algif_aead /run/current-system/sw/bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true

Determinate Secure Packages users who are not on Linux but not NixOS can use:

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true

We have confirmed that CVE-2026-31431 (a local privilege escalation in the kernel) impacts all Determinate Secure Packages users. This vulnerability is exploitable from within the Nix sandbox.

We are currently testing the patch for this vulnerability, and will follow up shortly with mitigation instructions.

See: https://copy.fail/