CVE-2026-31431 ansible playbook mitigation

CVE-2026-31431-mitigate.yml

---
- name: CIS | Disable algif_aead kernel module
  hosts: all
  become: true

  tasks:
    - name: "CIS | Ensure algif_aead is blacklisted via modprobe"
      ansible.builtin.copy:
        dest: /etc/modprobe.d/disable-algif_aead.conf
        content: |
          install algif_aead /bin/false
          blacklist algif_aead
        owner: root
        group: root
        mode: "0644"

    - name: "CIS | Unload algif_aead module if currently loaded"
      community.general.modprobe:
        name: algif_aead
        state: absent
      ignore_errors: true   # модуль может быть не загружен — это норма
      when: "'/proc/modules' is file"   # ← не пытаться в контейнерах без /proc/modules

    - name: "CIS | Verify algif_aead is not loaded"
      ansible.builtin.command:
        cmd: lsmod
      register: lsmod_output
      changed_when: false

    - name: "CIS | Assert algif_aead is absent from lsmod"
      ansible.builtin.assert:
        that: "'algif_aead' not in lsmod_output.stdout"
        fail_msg: "algif_aead is still loaded — check for dependent modules"
        success_msg: "algif_aead is not loaded"