Mitigation of CVE 2026-31431 for OpenShift

• Based on this: https://access.redhat.com/solutions/7141979
• https://access.redhat.com/security/cve/cve-2026-31431

Create a butane configuration file for worker nodes

variant: openshift
version: 4.20.0
metadata:
  name: 99-worker-cve-2026-31431
  labels:
    machineconfiguration.openshift.io/role: worker
openshift:
  kernel_arguments:
    - initcall_blacklist=algif_aead_init

Create a butane configuration file for control plane nodes

variant: openshift
version: 4.20.0
metadata:
  name: 99-master-cve-2026-31431
  labels:
    machineconfiguration.openshift.io/role: master
openshift:
  kernel_arguments:
    - initcall_blacklist=algif_aead_init

Convert butane config to machine config

butane 99-master-cve-2026-31431.bu -o 99-master-cve-2026-31431.yaml
butane 99-worker-cve-2026-31431.bu -o 99-worker-cve-2026-31431.yaml

Apply machine configs to OpenShift

oc create -f 99-master-cve-2026-31431.yaml

oc create -f 99-worker-cve-2026-31431.yaml