Determinate Systems, Inc. | Status

Updates

• May 1, 2026 12:39 AM UTC

  All Determinate Secure Packages distributions have the applicable patches.

  Resolved
• Apr 30, 2026 2:31 AM UTC (22 hours and 8 minutes earlier)

  The following kernel releases do not have the vulnerability:

  • 6.18.24 and later
  • 6.19.12 and later
  • 7.0 and later
  • Additionally, we have applied the patch to 6.12.81

  Patched kernels are now available in Determinate Secure Packages:
  * Determinate Secure Packages 25.11, v0.1.911988: inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-25.11/0.1";
  * Determinate Secure Packages Rolling, v0.1.980628: inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling/0.1";

  We are still building and testing the update for Determinate Secure Packages Rolling (FIPS).

  Monitoring
• Apr 30, 2026 12:04 AM UTC (2 hours and 27 minutes earlier)

  NixOS users who do not depend on the algif_aead kernel module can disable it via:

  boot.extraModprobeConfig = ''
  install algif_aead ${pkgs.busybox}/bin/false
  '';

  followed by running rmmod algif_aead 2>/dev/null || true.

  NixOS users can also disable the kernel module temporarily without a deployment via:

  echo "install algif_aead /run/current-system/sw/bin/false" > /etc/modprobe.d/disable-algif.conf
  rmmod algif_aead 2>/dev/null || true

  Determinate Secure Packages users who are not on Linux but not NixOS can use:

  echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
  rmmod algif_aead 2>/dev/null || true

  Identified
• Apr 29, 2026 11:53 PM UTC (10 minutes earlier)

  We have confirmed that CVE-2026-31431 (a local privilege escalation in the kernel) impacts all Determinate Secure Packages users. This vulnerability is exploitable from within the Nix sandbox.

  We are currently testing the patch for this vulnerability, and will follow up shortly with mitigation instructions.

  See: https://copy.fail/

  Identified