ashok523/cve-2026-31431Defensive IR playbook and detection package for CVE-2026-31431 (Copy Fail) Linux kernel LPE, including Sigma, auditd, Falco, Wazuh, YARA, eBPF, and SIEM hunt queries.
Production-ready IR playbook, detection rules, and SOC triage guidance for CVE-2026-31431 — a Linux kernel local privilege escalation in the algif_aead crypto interface. Includes an interactive HTML playbook, Sigma rules, auditd configs, Falco container rules, Wazuh correlation rules, YARA signatures, eBPF real-time monitors, and SIEM hunt queries across Splunk, Sentinel KQL, Elastic EQL, and QRadar AQL.
No exploit code — purely defensive content for SOC analysts and detection engineers.
Author: Ashok Reddy
The widely recommended modprobe blacklist does not work on RHEL, CentOS, AlmaLinux, Rocky Linux, or CloudLinux. The algif_aead module is compiled directly into the kernel (CONFIG_CRYPTO_USER_API_AEAD=y). The commands run without errors but leave the system completely unprotected.
Correct mitigation for RHEL-family:
grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"
reboot
# Verify:
cat /proc/cmdline | grep initcall_blacklist
See mitigate/ for platform-specific scripts.
├── README.md # This file
├── LICENSE # MIT License
├── playbook/
│ ├── index.html # Interactive IR Playbook (13 tabs)
│ └── triage_playbook.md # SOC analyst triage guide
├── sigma/
│ ├── afalg_socket_creation.yml # AF_ALG socket by non-root
│ ├── afalg_bind_aead_string.yml # authencesn algorithm string
│ └── afalg_splice_chain.yml # Behavioral chain rule
├── auditd/
│ └── cve-2026-31431.rules # Complete auditd ruleset
├── falco/
│ └── afalg_container.yml # Container AF_ALG detection
├── wazuh/
│ └── cve-2026-31431.xml # Wazuh correlation rules
├── yara/
│ └── copyfail_artifacts.yar # PoC file artifact detection
├── ebpf/
│ └── copyfail_monitor.bt # bpftrace real-time monitor
├── queries/
│ ├── splunk.spl # Splunk SPL hunt queries
│ ├── defender_sentinel.kql # Sentinel/MDE KQL queries
│ ├── elastic.eql # Elastic EQL sequences
│ └── qradar.aql # QRadar AQL queries
├── mitigate/
│ ├── mitigate_debian.sh # Debian/Ubuntu mitigation
│ └── mitigate_rhel.sh # RHEL-family (grubby method)
└── check/
└── is_vulnerable.sh # Safe vulnerability check
The playbook/index.html is a full interactive playbook with 13 tabs:
Live: https://ashok523.github.io/cve-2026-31431/
# 1. Check if vulnerable
sudo bash check/is_vulnerable.sh
# 2. Apply mitigation
sudo bash mitigate/mitigate_rhel.sh # RHEL-family
sudo bash mitigate/mitigate_debian.sh # Debian/Ubuntu
# 3. Deploy auditd rules
sudo cp auditd/cve-2026-31431.rules /etc/audit/rules.d/
sudo augenrules --load
# 4. Deploy Wazuh rules
sudo cp wazuh/cve-2026-31431.xml /var/ossec/etc/rules/local_rules.xml
sudo systemctl restart wazuh-manager
# 5. Deploy Falco rule (Kubernetes)
sudo cp falco/afalg_container.yml /etc/falco/rules.d/
sudo systemctl restart falco
# 6. Run eBPF monitor (real-time)
sudo bpftrace ebpf/copyfail_monitor.bt
# 7. Scan for PoC files
yara yara/copyfail_artifacts.yar /tmp/ /dev/shm/ /var/tmp/
This repository contains defensive detection content only. No exploit code, proof-of-concept scripts, syscall offsets, or shellcode are included or will be added.
| Field | Detail |
|---|
| CVE | CVE-2026-31431 |
| Nickname | Copy Fail |
| Component | Linux kernel algif_aead (AF_ALG crypto interface) |
| Type | Local Privilege Escalation (LPE) |
| CVSS | 7.8 (HIGH) |
| Primitive | Deterministic 4-byte write into any readable file's page cache |
| Exploit size | 732 bytes Python (standard library only, Python 3.10+) |
| Reliability | 100% — no race condition, no retries |
| Disk writes | Zero — page-cache only, invisible to FIM tools |
| Scope | Every major Linux distro since 2017 (kernel 4.13–6.18) |
| Container risk | Container-escape primitive if host kernel unpatched (T1611) |
| PoC status | Public since 29 April 2026 |
| Patch | Commit a664bf3d603d — reverts in-place AEAD operations |
| Discovered by | Taeyang Lee (Theori) · Exploit chain by Xint Code (AI-assisted) |
| Tab | Content |
|---|
| Overview | Attack graph, exploit chain, stats |
| Phases 1–6 | Complete IR lifecycle with checklists |
| Intel Feed | SOC detection methodology, VAPT vs SOC, community tools, patch status |
| IOCs | Syscall, process, filesystem, behavioral indicators |
| MITRE ATT&CK | Technique mapping with detection signals |
| Detection Use Cases | 8 TTP-based use cases (UC-CF-001 through UC-CF-008) |
| SIEM Hunting | 18 queries across all platforms |
| AI Detection | UEBA/ML capabilities and limitations |
| Stage | Detection | Tool |
|---|
| AF_ALG socket by non-root | Sigma · auditd · Falco · eBPF | Primary signal |
| splice() chain (same PID, 10s) | auditd · eBPF | Near-zero FP |
| authencesn AEAD string | Sigma · auditd | Critical if observed |
| uid→euid=0 without auth | auditd · Splunk · KQL | LPE confirmed |
| su with missing username | auth.log (Wiz signal) | Post-exploitation |
| PoC on filesystem | YARA | Staging detection |
| Container escape | Falco with K8s context | T1611 |
| Post-root persistence | auditd FIM · Wazuh | SSH keys, SUID, cron |
| Approach | Volume | Confidence |
|---|
| ❌ Alert on all splice() | ~10,000/hr | Very Low |
| ⚠️ Alert on socket(AF_ALG) alone | ~5–50/day | Medium |
| ✅ AF_ALG + splice same PID/10s | ~0–2/day | Very High |
| ✅ AF_ALG + splice + su / 60s | ~0/day | Critical |
| Distribution | Status | Command |
|---|
| Ubuntu | ✅ Patched | apt update && apt install linux-image-generic |
| AlmaLinux | ✅ Patched | dnf clean metadata && dnf upgrade |
| CloudLinux | ✅ Patched + livepatch | kcarectl --update |
| Debian | ✅ Tracked | apt update && apt upgrade |
| Mainline | ✅ Fixed 7.0-rc7 | Commit a664bf3d603d |
| RHEL | ⏳ Pending | Errata not yet released |
| Amazon Linux | 🔄 Tracking | yum update kernel |