AF_ALG is a socket family. Userspace talks to the kernel crypto API through it. Fedora, per LWN on 18 Aug 2026, is preparing to restrict that deprecated path in the next release. The write-up ties the hurry to recent high-profile flaws, including Copy Fail. That is a named interface, a named distro, and a named reason. Not "Linux security news."
If you never heard of AF_ALG, you still might have it. Some language bindings, some VPN helpers, some "use the kernel, it is faster" libraries open that socket and assume it stays. Distro policy is how those assumptions die.
What we inventory
uname -r on every class of box, not one "Linux estate" slide. Fedora vs Ubuntu LTS vs a vendor kernel that froze in 2022. Which process still opens AF_ALG. Whether your image builder pins a userspace crypto library that will fail closed or fail open when the socket goes away.
kernel.org published 7.1.9 stable the same week, plus the usual longterm point releases. Fine. A stable tag is not a fleet plan. Website maintenance services for us includes the kernel line, not only WordPress plugins and TLS certs. If the app is a Next box on a VPS, the kernel is still your problem.
I will not pretend I have audited your ss output from here. I am saying the ticket should exist before Fedora's change lands in a point release you took because unattended-upgrades was green.
What we will not sell
A "move to eBPF" slogan because a crypto socket is going away. A wholesale distro migration quoted as a weekend. If the consumer is one forgotten binary, we replace that binary.
When a Windows shop patches Defender and the agent dies, we treat that as the same class of work: prove the control still runs. That story is the patch that broke the guard. Linux just uses quieter release notes.
We keep the kernel branch mapped and the leftover sockets listed. Request a quote if nobody on the team owns uname after the app team shipped.
Copy Fail was a reminder that "kernel does crypto" is still attack surface. Fedora is doing the boring part: turning the socket off. Do the boring part on your images before the next release notes do it for you.
Sources
- Fedora prepares for the end of AF_ALG — LWN.net, 18 Aug 2026 (subscriber link; cite LWN if you hit the paywall)
- Kernel releases — kernel.org, 19 Aug 2026 (7.1.9 stable and longterm point releases)