GLF-OS enables a mitigation by default against three Local Privilege Escalation (LPE) vulnerabilities recently disclosed in the Linux kernel. No action is required for 99 %+ of gamers.
| CVE | Nickname | Kernel component | Severity |
|---|---|---|---|
| CVE-2026-31431 | Copy Fail | AF_ALG crypto API (authencesn template) |
CVSS 7.8 (HIGH) |
| CVE-2026-43284 | Dirty Frag (ESP) | IPsec ESP esp4 / esp6 |
Important |
| CVE-2026-43500 | Dirty Frag (rxrpc) | RPC rxrpc (kAFS) |
Important |
All three allow a local unprivileged user to gain root in seconds via publicly available exploit scripts.
The glf.security.mitigations module (enabled by default on testing from May 2026) blacklists the vulnerable kernel modules. As a result, these modules no longer auto-load when an unprivileged program tries to open a socket that would normally trigger them (the typical exploit path).
| Blocked module | CVE covered | Normal usage |
|---|---|---|
algif_aead |
Copy Fail | Rarely used from userspace (already patched at kernel level, blacklist is defense-in-depth) |
esp4, esp6 |
Dirty Frag (ESP) | Corporate IPsec VPN (strongSwan, libreswan, Cisco native IKEv2) |
rxrpc |
Dirty Frag (rxrpc) | Andrew File System (AFS) — academic use only |
| You use… | Impact |
|---|---|
| Steam, Proton, Wine, Lutris, Heroic, Bottles | ✅ None |
| EAC, BattlEye anti-cheats (Linux/Proton side) | ✅ None |
| WireGuard, OpenVPN, Tailscale, ZeroTier | ✅ None (they don't use kernel IPsec ESP) |
| ProtonVPN, Mullvad, NordVPN (standard clients) | ✅ None |
| Corporate kernel xfrm IPsec VPN (strongSwan/libreswan/Cisco native IKEv2) | ⚠️ Broken while the mitigation is active |
| AFS (in-kernel kAFS) | ⚠️ Broken |
If you fall in the last category, explicitly disable the mitigation:
# /etc/nixos/customConfig/default.nix
glf.security.mitigations.blacklistDirtyFrag = false;
Then:
glf-update
grep -E "esp4|esp6|rxrpc|algif_aead" /etc/modprobe.d/nixos.conf
You should see four blacklist lines. If yes, you are protected.
lsmod | grep -E "esp[46]|rxrpc|algif_aead"
Expected output: empty (modules not loaded).
a664bf3d603d, included in Linux 6.18.22+). GLF-OS ships 6.18.26 → patch already in the kernel; the algif_aead blacklist is purely preventive.f4c50a4034e6) merged on 2026-05-07. Will land in a 6.18.x stable shortly, propagated through nixpkgs.GLF-OS will automatically lift the blacklist via glf.security.mitigations as soon as the distributed kernel includes all the fixes.