Skip to content

fix(ci): workaround CVE-2026-31431#566

Merged
dd23 merged 5 commits into
mainfrom
fix/cve-2026-31431
May 20, 2026
Merged

fix(ci): workaround CVE-2026-31431#566
dd23 merged 5 commits into
mainfrom
fix/cve-2026-31431

Conversation

@chilcano
Copy link
Copy Markdown
Contributor

@chilcano chilcano commented May 4, 2026

Adds a kernel module blacklist step as the first step in every job as a workaround for CVE-2026-31431.

@chilcano chilcano requested review from a team as code owners May 4, 2026 17:04
@cla-bot cla-bot Bot added the cla-signed The CLA has been signed. label May 4, 2026
@chilcano
Copy link
Copy Markdown
Contributor Author

chilcano commented May 4, 2026

FYI @dvdplm - This the status once applied the workaround:

zama-ai/kms
  applied: build-and-test.yml
  applied: check-rust-stable-version.yml
  applied: ci_lint.yml
  applied: codeql.yml
  applied: common-docker-big-instance.yml
  applied: common-nitro-enclave.yml
  applied: common-release-workspace-cargo.yml
  applied: common-testing-big-instance.yml
  skip (no ubuntu jobs): common-testing.yml
  applied: common-update-argocd.yml
  applied: dependencies_analysis.yml
  applied: docker-build.yml
  applied: docker-check-build.yml
  applied: docker-scan.yml
  applied: helm-lint.yml
  applied: helm-release.yml
  applied: helm-test.yml
  applied: kind-testing.yml
  applied: main.yml
  applied: npm-release.yml
  applied: performance-testing.yml
  skip (no ubuntu jobs): pr-preview-deploy.yml
  skip (no ubuntu jobs): pr-preview-destroy.yml
  applied: release.yml
  applied: rolling-upgrade-testing.yml
  skip (no ubuntu jobs): rust-lint.yml
  applied: sync-on-push.yml
  applied: test-reporter.yml
  applied: wasm-testing.yml

Workflows: 29 found, 25 updated, 4 skipped.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 4, 2026 •
edited
Loading

Consolidated Tests Results 2026-05-19 - 18:35:15

Test Results

passed 7 passed

Details

tests 7 tests
clock not captured
tool junit-to-ctrf
build build-and-test arrow-right test-reporter link #2249
pull-request fix(ci): workaround CVE-2026-31431 link #566

test-reporter: Run #2249

Tests 📝 Passed ✅ Failed ❌ Skipped ⏭️ Pending ⏳ Other ❓ Flaky 🍂 Duration ⏱️
7 7 0 0 0 0 0 not captured

🎉 All tests passed!

Tests

View All Tests
Test Name Status Flaky Duration
k8s_test_crs_uniqueness ✅ 42.5s
k8s_test_insecure_keygen_encrypt_and_public_decrypt ✅ 1m 55s
k8s_test_insecure_keygen_encrypt_multiple_types ✅ 2m 7s
k8s_test_keygen_and_crs ✅ 1m 58s
k8s_test_keygen_uniqueness ✅ 4m 48s
k8s_test_centralized_insecure ✅ 54.9s
nightly_full_gen_tests_default_k8s_centralized_sequential_crs ✅ 1.6s

🍂 No flaky tests in this run.

Github Test Reporter by CTRF 💚

🔄 This comment has been updated

dvdplm
dvdplm previously approved these changes May 4, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@dvdplm dvdplm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@dvdplm
Copy link
Copy Markdown
Contributor

dvdplm commented May 4, 2026

The CI failures seem a bit odd though... :/

@dd23
Copy link
Copy Markdown
Member

dd23 commented May 6, 2026

Apparently github images already have the module disabled, so not sure if we still have to do anything?
See actions/runner-images#13987 (comment)

@chilcano chilcano force-pushed the fix/cve-2026-31431 branch from 2bfbf10 to 8f9e76c Compare May 7, 2026 13:07
@chilcano chilcano changed the title Workaround CVE-2026-31431 fix(ci): workaround CVE-2026-31431 May 7, 2026
@chilcano
Copy link
Copy Markdown
Contributor Author

chilcano commented May 7, 2026

The Ubuntu runner apparently has the module is disabled.
If the module is already disabled (not loaded, not built-in), neither condition is true, so the if/elif block is simply skipped by falling through.
Up to you guys.
BTW, I've solved the conflicts.

@dvdplm
Copy link
Copy Markdown
Contributor

dvdplm commented May 7, 2026

Up to you guys.

Are you saying it is up to us if we want to merge this or not? I think we should, and the sooner the better!

dd23
dd23 previously approved these changes May 11, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@dd23 dd23 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! LGTM

@jot2re
Copy link
Copy Markdown
Collaborator

jot2re commented May 20, 2026

@chilcano can we merge this?

@dd23 dd23 merged commit 7410b64 into main May 20, 2026
60 checks passed
@dd23 dd23 deleted the fix/cve-2026-31431 branch May 20, 2026 09:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dd23 dd23 dd23 approved these changes

@fegmorte fegmorte fegmorte approved these changes

@dvdplm dvdplm dvdplm left review comments

Assignees

No one assigned

Labels

cla-signed The CLA has been signed.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@chilcano @dvdplm @dd23 @jot2re @fegmorte