Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-31431_SCA_WAZUH — Wazuh SCA Linux hardening policy for Copy Fail (CVE-2026-31431) | Kitploit
Tools/GitHubGitHub/adampielak/cve-2026-31431_sca_wazuh
Vulnerability ScannersContainer SecurityConfiguration AuditingIncident Response
GitHubadampielak/cve-2026-31431_sca_wazuh

CVE-2026-31431_SCA_WAZUH

Wazuh SCA Linux hardening policy for Copy Fail (CVE-2026-31431)

View Repository
Website
212 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Wazuh SCA policy: Copy Fail (CVE-2026-31431)

Wazuh Type License

This policy file:

  • copy-fail-cve-2026-31431-policy.yml

is designed to detect likely exposure and mitigation status for Copy Fail / CVE-2026-31431.

What this policy checks

  1. algif_aead is disabled via modprobe policy.
  2. algif_aead is not currently loaded.
  3. Mitigation file exists (/etc/modprobe.d/disable-algif.conf).
  4. Reboot-after-kernel-update heuristics are clean.
  5. Best-effort seccomp control includes AF_ALG (container hosts).

Why this is mitigation-first

For this CVE, distribution backports make exact version matching unreliable with simple regex checks. So this SCA policy focuses on:

  • runtime exploit-path reduction,
  • operational patch hygiene,
  • and container hardening signals.

Deploy on agent

Copy policy to:

  • /var/ossec/ruleset/sca/copy-fail-cve-2026-31431-policy.yml

Enable SCA in /var/ossec/etc/ossec.conf if needed:

root@kitploit:~
  <sca>
    <enabled>yes</enabled>
    <scan_on_start>yes</scan_on_start>
    <interval>14h</interval>
    <policies>
      <policy>/var/ossec/etc/shared/copy-fail-cve-2026-31431-policy.yml</policy>
    </policies>
  </sca>

Restart manager or agent:

root@kitploit:~
sudo systemctl restart wazuh-agent

Temporary mitigation commands (from public guidance)

root@kitploit:~
echo "install algif_aead /bin/false" | sudo tee /etc/modprobe.d/disable-algif.conf
sudo rmmod algif_aead 2>/dev/null || true

Then reboot after patched kernel update.

Notes

  • Check 110005 may be Not applicable on non-container hosts.
  • If your environment stores seccomp profiles in another path, duplicate/adjust that check.
  • If you want strict vendor-kernel package checks (Ubuntu/RHEL/SUSE specific), add distro-scoped checks per package manager output.
Download Tool