Scenario

• Product: ZCF
• Components: ZCE-X, ZStack Cloud
• ZCE-X version: 5.2.x
• ZStack Cloud version: 4.8.x
• Trigger: A scan detects the local high-risk privilege-escalation vulnerability CVE-2026-31431, requiring the official Kylin temporary mitigation.

Symptoms

• The target host is affected by CVE-2026-31431.
• The remediation applies to the host operating-system kernel layer.
• The procedure can require host restart.

Assessment

1. Confirm the maintenance window and host-migration arrangement before remediation.
2. Verify that the algif_aead module is deleted or disabled after remediation.
3. If the script requests a restart, verify again after restart.

Cause

This is a local high-risk privilege-escalation vulnerability in Kylin OS. Remediation is completed at the host operating-system layer with the official Kylin temporary mitigation script, not in platform business logic.

Resolution

1. Preparation

• Risk level: Medium.
• Disable global VM high availability.
• Back up databases on both management nodes.
• Migrate VMs in advance or coordinate a maintenance window to avoid host-restart impact.

2. Back up databases:

   zstack-ctl dump_mysql
   zstack-ctl dump_mysql

• Expected result: Platform-side protections are available.

3. Download the official remediation script:

   https://security-oss.kylinos.cn/Desktop/CVE-2026-31431/kylin_mitigate-CVE-2026-31431.zip

• Expected result: The official Kylin remediation package is available.

4. Upload it to /root on the host and extract it:

   unzip kylin_mitigate-CVE-2026-31431.zip

• Expected result: The script is executable.

5. Run the remediation script on the host:

   bash kylin_mitigate-cve-2026-31431.sh/kylin_mitigate-cve-2026-31431.sh

• Expected result: The official temporary mitigation is applied.

6. Verify remediation:

   ll /lib/modules/4.19.90-52.48.v2207.ky10.x86_64/kernel/crypto/algif_aead.ko.xz
   cat /etc/modprobe.d/disable-algif-aead.conf

• Expected result: - The module is deleted or can no longer be loaded normally.
• disable-algif-aead.conf is created.

7. Restart the host only if the script requires it.

• Expected result: When restart is required, the mitigation takes effect after restart.

8. After remediating all hosts, confirm no exception and enable global VM high availability.

• Expected result: The vulnerability is remediated and normal platform operation is restored.

Verification

• Verify the status of algif_aead.ko.xz and the disable configuration file.
• Verify successful script execution.
• If a host was restarted, verify normal host and platform recovery.

Risks and rollback

• Risk: Remediation can require host restart; coordinate a maintenance window first.
• Risk: Workload continuity can be affected if VMs are not migrated in advance.
• Risk level: Medium.
• No rollback is required for this security-vulnerability remediation.