[Solved] cmsec reporting indeterminate for CVE's on AlmaLinux 9.8 kernel 5.14.0-687.12.1.el9_8

• CentOS Version: AlmaLinux 9.8
• Centmin Mod Version Installed: 140.00beta01.b351

Code (Text):

[XX] cmsec: kernel 5.14.0-687.12.1.el9_8.x86_64 — 5/5 checked: 0 patched, 1 n/a, 0 VULNERABLE, 4 indeterminate
[XX] cmsec INDETERMINATE: CVE-2026-31431, CVE-2026-43284, CVE-2026-46300, CVE-2026-46333

RESULT: The running kernel and the known fixed version are from different package families, and the running kernel's changelog does not record...

It looks like those CVE's have been removed from the latest changelog and so cmsec reports "indeterminate".

---

 

Yeah I always make sure I'm up to date (currently 140.00beta01.b351).

If cmsec's detection logic is relying on the latest changelog, the CVEs have been removed:

Code (Text):

root@server:~#dnf repoquery --changelog kernel-core-$(uname -r)
Extra Packages for Enterprise Linux 9 - x86_64                                                                                        81 MB/s |  22 MB     00:00
AlmaLinux 9 - AppStream                                                                                                               28 MB/s |  13 MB     00:00
AlmaLinux 9 - CRB                                                                                                                    8.0 MB/s | 3.5 MB     00:00
Percona Telemetry release/x86_64 YUM repository                                                                                      264 kB/s | 5.5 kB     00:00
Remi's Modular repository for Enterprise Linux 9 - x86_64                                                                            6.6 MB/s | 1.1 MB     00:00
Changelog for kernel-core-5.14.0-687.12.1.el9_8.x86_64
* Sun Jun 07 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.12.1
- Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable
  backports (SOURCES/1198-1252)
- RHEL changelog for 687.11.1..687.12.1 follows:

* Mon May 25 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.12.1.el9_8]
- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]

* Tue May 19 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.11.1.el9_8]
- mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}

However, checking the full RPM changelog shows they are present, e.g.:

Code (Text):

root@server:~#rpm -q --changelog kernel-core | grep CVE-2026-43284
- xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284)

 

Just updated the kernel, same issue:

Code (Text):

root@server:~#uname -r
5.14.0-687.15.1.el9_8.x86_64
root@server:~#cmsec check cve-2026-31431
 * cmsec: running cve-2026-31431 check, please wait...

== CVE ==
CVE-2026-31431 / Copy Fail kernel local privilege escalation checker
Tool version: 0.6-cmsec  Mode: read-only

== Tool availability ==
rpm: found
dnf: found
grubby: found
modinfo: found
python3: found
systemd-detect-virt: found
kcarectl: not found

== OS ==
NAME: AlmaLinux
PRETTY_NAME: AlmaLinux 9.8 (Olive Jaguar)
ID: almalinux
VERSION_ID: 9.8

== Container / chroot detection ==
No container marker detected.

== Running kernel ==
5.14.0-687.15.1.el9_8.x86_64

This is the kernel your system is currently running.
This is what determines whether your system is vulnerable or patched right now.
Even if a newer, fixed kernel package is installed, it does not take effect until you reboot.

== Installed kernels ==
kernel-5.14.0-687.5.4.el9_8.x86_64
kernel-5.14.0-687.12.1.el9_8.x86_64
kernel-5.14.0-687.15.1.el9_8.x86_64
kernel-core-5.14.0-687.5.4.el9_8.x86_64
kernel-core-5.14.0-687.12.1.el9_8.x86_64
kernel-core-5.14.0-687.15.1.el9_8.x86_64

== Default boot kernel ==
/boot/vmlinuz-5.14.0-687.15.1.el9_8.x86_64

This is the kernel your system will use after the next reboot.
If this differs from the running kernel above, a reboot is needed to switch to it.

== Running kernel RPM mapping ==
kernel-core-5.14.0-687.15.1.el9_8.x86_64 (matched via kernel-core package name)

== CVE updateinfo ==

The above lists available security updates that fix this CVE.
If any are shown, your system has a fix available - install updates and reboot to apply.

== Available kernel updates ==
All kernel packages are up to date - no updates available.

== Kernel changelog hints ==
- crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431)

Note: not all vendors include CVE references in their changelogs.
No match here does not mean the system is vulnerable - other checks above are more reliable.

== algif_aead state ==
Detected state: builtin
algif_aead is built into the kernel (not a loadable module).
This means it cannot be disabled via modprobe.d blacklisting.
The only workaround is the initcall_blacklist boot parameter or a kernel update (see below).

== Temporary mitigation status ==
The temporary workaround (initcall_blacklist=algif_aead_init) is NOT active.
If you cannot update the kernel immediately, see 'Suggested next actions' below to enable it.

== Boot entries with temporary mitigation ==
No boot entries have the temporary workaround configured.
This means the workaround will not be active after a reboot.

== Livepatch tooling status ==
KernelCare kcarectl not found
kpatch packages not detected

If you use a livepatch service, check with your vendor that it covers CVE-2026-31431.
The kernel version string alone does not confirm whether a livepatch has been applied.

== AF_ALG AEAD bind probe ==
Active probing has been moved to a separate file in the Centmin Mod cmsec edition.
To test AF_ALG AEAD bind reachability (creates a real PoC-algorithm socket and may
trigger SOC/EDR/auditd alarms): cmsec probe cve-2026-31431 --yes

== Vendor running-kernel assessment ==
Detected OS:     AlmaLinux 9.8 (Olive Jaguar)
Vendor branch:   AlmaLinux 9
Running kernel:  5.14.0-687.15.1.el9_8
Fixed baseline:  5.14.0-611.49.2.el9_7

RESULT: The running kernel and the known fixed version are from different package families,
and the running kernel's changelog does not record CVE-2026-31431.
A direct version comparison would be unreliable, so it was skipped.
Verify manually with: dnf repoquery --changelog kernel-core-$(uname -r)
or your vendor's security advisory (see suggested actions below).

== Linode/Akamai Cloud kernel assessment ==
No Linode-provided kernel marker detected in uname -r.

== Provider/custom kernel warning ==
No obvious provider/custom kernel marker detected in uname -r.

== Suggested next actions ==
1. UPDATE AND REBOOT (recommended fix):
   Install all available updates and restart the system:
     dnf clean metadata
     dnf --refresh upgrade
     reboot
   If you use CloudLinux/KernelCare/livepatch, also confirm with your vendor that
   their livepatch covers CVE-2026-31431.

2. VERIFY AFTER REBOOT:
   After restarting, confirm the new kernel is running:
     uname -r
   Then re-run this script to verify the system now shows as patched.

3. TEMPORARY WORKAROUND (if you cannot reboot immediately):
   Block the vulnerable kernel code path without updating the kernel:
     grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"
     reboot
   Note: this still requires a reboot, but does not require a kernel update.

4. CLEAN UP WORKAROUND (after applying the kernel update):
   Once you have updated to a patched kernel, remove the workaround:
     grubby --update-kernel=ALL --remove-args="initcall_blacklist=algif_aead_init"
     reboot

5. LINODE/AKAMAI CLOUD USERS:
   If your kernel name contains 'linode', running 'dnf upgrade' inside the OS will
   NOT change the running kernel. Linode manages the kernel separately.
   Linode kernel 7.0.3 or newer includes the CVE-2026-31431 fix.
   To update: open Cloud Manager > select your Linode > Configuration > change the
   kernel to the latest version (or switch to GRUB 2 to manage it via dnf), then reboot.

== Final status ==
STATUS: indeterminate  CONFIDENCE: low  EXIT: 3

The script could not determine whether your system is vulnerable or patched.
See the reasons below and check manually.

Reasons:
  - Running kernel suffix family does not match AlmaLinux 9 baseline; changelog did not record CVE-2026-31431; comparison would be misleading.

 

All resolved with the latest update, thank you.