Itsumma AF_ALG Check

Diagnostic utility for Linux that checks:

• availability of AF_ALG / algif_aead and helps assess the risk of CVE-2026-31431 (copy-fail);
• the presence of an attack surface for the Dirty Frag vulnerability class (xfrm-ESP Page-Cache Write + RxRPC Page-Cache Write chain) across the esp4, esp6, rxrpc components and prints mitigation.

The tool is intended for defensive checks and is not an exploit.

Features

• performs a runtime socket + bind probe for AF_ALG AEAD;
• analyzes kernel components via /proc/modules, modules.builtin, modules.builtin.modinfo;
• attempts to detect the presence of a vendor backport fix via changelog (rpm/Debian changelog);
• shows processes holding AF_ALG sockets (/proc/*/fd, best effort);
• prints mitigation recommendations for different distribution families.

Additionally for Dirty Frag:

• checks for the presence of esp4, esp6, rxrpc (loaded / built-in / unknown);
• performs runtime probes socket(AF_NETLINK, NETLINK_XFRM) and socket(AF_RXRPC) without changing system configuration;
• prints emergency mitigation (disabling module loading + attempting unload) if the components are present.

Requirements

• Linux;
• Go 1.24+;
• for a full /proc/*/fd scan, it is better to run as root.

Build

The entrypoint is located at the project root; the build is performed from the root:

go build -o itsumma-afalg-check .

Run

./itsumma-afalg-check

What the utility outputs

At startup:

Itsumma Security Check — AF_ALG / CVE-2026-31431

Then:

• the result of the runtime AF_ALG probe (socket + bind);
• kernel version and availability of modules.builtin;
• the state of af_alg and algif_aead (loaded / built-in / unknown);
• the final assessment for CVE-2026-31431 (including an attempt to determine the vendor backport);
• a list of current processes with AF_ALG sockets (if found);
• step-by-step mitigation commands and post-checks after reboot.

Basic post-check after mitigation

cat /proc/cmdline
echo 3 | sudo tee /proc/sys/vm/drop_caches
modprobe -n -v algif_aead
lsmod | grep '^algif_aead\b' || echo 'algif_aead not loaded'
./itsumma-afalg-check

For the built-in scenario, instead of modprobe/lsmod it is additionally useful to check:

dmesg | grep -i 'algif_aead\|initcall_blacklist'

Dirty Frag: basic mitigation command

The command from the public Dirty Frag runbook (disables loading of esp4, esp6, rxrpc and attempts to unload already loaded modules).

If IPSec / XFRM is in use (e.g., via strongSwan), it is recommended to perform a flush before unloading modules:

sudo ip xfrm state flush
sudo ip xfrm policy flush
echo 3 | sudo tee /proc/sys/vm/drop_caches

If esp4/esp6/rxrpc are built as built-in (visible only in modules.builtin), modprobe blacklist and rmmod will not disable them: in this case, a kernel update/rebuild is required.

For strongSwan, after installing libcharon-extra-plugins, enable kernel-libipsec:

sudo sed -i 's/^\s*load\s*=\s*no/load = yes/' /etc/strongswan.d/charon/kernel-libipsec.conf
sudo systemctl restart strongswan || sudo systemctl restart strongswan-starter

lsmod | egrep '^(esp4|esp6|rxrpc)\b' || echo 'esp4/esp6/rxrpc not loaded'
sudo modprobe esp4 esp6 rxrpc || true
sudo modprobe -r esp6 rxrpc
sudo modprobe -r esp4 || true
sudo rmmod -f esp4
sudo sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp6 rxrpc 2>/dev/null; rmmod -f esp4 2>/dev/null; true"

Post-check:

modprobe -n -v esp4 esp6 rxrpc
lsmod | egrep '^(esp4|esp6|rxrpc)\b' || echo 'esp4/esp6/rxrpc not loaded'
./itsumma-afalg-check

Important

• The utility is diagnostic in nature and does not replace a vendor kernel update.
• The presence of algif_aead means an attack surface, but the final conclusion depends on the kernel version and distribution backport patches.
• If the runtime AF_ALG AEAD probe fails, the vector is considered unavailable within this check.