DSA-2026-223: Security Update for Dell Enterprise Sonic Distribution Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284, CVE-2026-43500) 

For customers who configure general Linux shell access or want to implement defense-in-depth measures, we recommend adding an additional filter to block dynamic loading of the affected modules.

1) Disable Vulnerable Kernel Module Loading

From the Linux shell as system admin add the following filter to your system configuration:

#Restrict loading of the affected kernel modules

echo "install algif_aead /bin/false" | sudo tee /etc/modprobe.d/disable-algif.conf

echo "install esp4 /bin/false" | sudo tee /etc/modprobe.d/disable-esp4.conf

echo "install rxrpc /bin/false" | sudo tee /etc/modprobe.d/disable-rxrpc.conf

If OSPFv3 IPSec authentication is not in use, apply the additional filter below as well:

echo "install esp6 /bin/false" | sudo tee /etc/modprobe.d/disable-esp6.conf

After applying the configuration, update module preferences:

sudo depmod -a

2) Verification

To verify the module is blocked:

#Check if any of the modules are active

lsmod | grep -E 'algif_aead|rxrpc|esp4|esp6'

#If necessary, unload the module if it is currently loaded

sudo modprobe -r <module_name>

#Attempt to load each module (should fail)

sudo modprobe algif_aead

#Expected output: modprobe: ERROR: ../libkmod/libkmod-module.c:1047 command_do() Error running install command '/bin/false' for module algif_aead: retcode 1

Persistence

The configuration will persist across system reboots. No additional steps are required.