From d4c7b2bfe30cd341160edb4f99831f8e91289c7b Mon Sep 17 00:00:00 2001
From: Rine Amakawa <Misaka13514@gmail.com>
Date: Fri, 8 May 2026 17:59:46 +0800
Subject: [PATCH] [F] Add modprobe config to mitigate dirtyfrag & copyfail

---
 hosts/ctvp.nix | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/hosts/ctvp.nix b/hosts/ctvp.nix
index e871dd4..711d47e 100644
--- a/hosts/ctvp.nix
+++ b/hosts/ctvp.nix
@@ -1,4 +1,4 @@
-{ modulesPath, ... }:
+{ modulesPath, pkgs, ... }:
 {
   system.stateVersion = "24.05";
   imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
@@ -13,4 +13,15 @@
   security.sudo.wheelNeedsPassword = false;
   networking.firewall.enable = false;
 
+  boot.extraModprobeConfig = ''
+    # Mitigate CVE-2026-43284 CVE-2026-43500 https://dirtyfrag.io
+    # https://github.com/V4bel/dirtyfrag
+    install esp4 ${pkgs.coreutils}/bin/false
+    install esp6 ${pkgs.coreutils}/bin/false
+    install rxrpc ${pkgs.coreutils}/bin/false
+
+    # Mitigate CVE-2026-31431 https://copy.fail
+    # https://github.com/theori-io/copy-fail-CVE-2026-31431
+    install algif_aead ${pkgs.coreutils}/bin/false
+  '';
 }