documentation/docs/admin-guide/copyfail_mitigation.md

copy.fail Mitigation

The provided fix by RedHat for the mitigation of the copy.fail vulnerability will affect all installed kernels and future kernels trough using --update-kernel=ALL We assume that in the next kernel update by RedHat they will also provide a patched kernel

Following CLI Input can be used to only patch the current default kernel.

# Blacklist algif_aead_init
grubby --update-kernel="$(grubby --default-kernel)" --args="initcall_blacklist=algif_aead_init"

# Reboot the system
reboot now

# Verify the parameter
cat /proc/cmdline | grep initcall_blacklist

# double check loaded Kernel
uname -r


# [root@lx-term-02 ~]# cat /proc/cmdline | grep initcall_blacklist
# BOOT_IMAGE=(hd0,gpt2)/vmlinuz-5.14.0-611.42.1.el9_7.x86_64 root=/dev/mapper/vg_root-lv_root ro crashkernel=1G-2G:192M,2G-64G:256M,64G-:512M resume=UUID=4cfc7133-5787-42ec-bfbe-1fd3fbfb643f rd.lvm.lv=vg_root/lv_root initcall_blacklist=algif_aead_init
# [root@lx-term-02 ~]# uname -r
# 5.14.0-611.42.1.el9_7.x86_64i