What I learned from patching Docker Engine default seccomp profile for CVE-2026-31431 (Copy Fail)
1. If a seccomp rule already filters an argument (like AF_VSOCK), it's just a matter of adding a second negation for the AF_ALG, right?
Wrong!
These are two rules that ...