thrandomv/cve-2026-31431-detectionDefensive detection package for CVE-2026-31431 (Linux kernel AF_ALG LPE). Sigma, Falco, auditd, KQL, and EQL rules mapped to MITRE ATT&CK T1068/T1611. Includes detection logic designed for auditd, eBPF, and EDR telemetry pipelines.
A production-ready collection of detection rules and triage guidance for
CVE-2026-31431, a Linux kernel local privilege escalation in the algif_aead
crypto interface disclosed by Theori (Xint Code Research). The vulnerability
exploits an in-place AEAD optimisation to allow an unprivileged user to
perform a controlled write into the page cache of any readable file. This
repository provides Sigma rules (including a behavioural chain rule), auditd
configurations, a Falco rule for containers, KQL and Elastic EQL hunt queries,
and a step-by-step analyst triage playbook. No exploit code — purely defensive
content for SOC analysts and detection engineers.
Includes detection logic designed for auditd, eBPF, and EDR telemetry pipelines.
| Field | Detail |
|---|---|
| CVE | CVE-2026-31431 |
| Nickname | Copy Fail |
| Component | Linux kernel algif_aead (AF_ALG crypto interface) |
| Type | Local Privilege Escalation (LPE) |
| CVSS | 7.8 |
| Primitive | Deterministic 4-byte controlled write into any readable file's page cache |
| Escalation path | Poison /etc/passwd page cache → getpwnam() returns UID 0 → su lands root |
| Container risk | If host kernel is unpatched and AF_ALG is not blocked by seccomp, this is a container-escape primitive (T1611) |
| Patch | Revert algif_aead to out-of-place AEAD operations (upstream) |
Apply the upstream fix that reverts algif_aead to out-of-place AEAD operations.
Distro advisories:
Temporary mitigation (unpatched systems):
Place install algif_aead /bin/false in /etc/modprobe.d/disable-algif-aead.conf,
or apply a seccomp profile blocking socket calls with AF_ALG (family 38).
The primary legitimate consumers of AF_ALG sockets are cryptsetup (LUKS), fscrypt,
and some kernel-crypto-aware VPN clients. In production environments these processes
almost exclusively run as root, so the uid != 0 filter eliminates the vast majority
of benign activity. The specific AEAD string authencesn(hmac(sha256),cbc(aes)) has
no known legitimate production usage and can be treated as critical when observed.
This repository contains defensive detection content only. No exploit code, proof-of-concept scripts, syscall offsets, or shellcode are included or will be added.
| Stage | Observable behaviour | Detection |
|---|
| Initial | AF_ALG socket (family 38) by non-root | Sigma Rule 1 · auditd afalg_socket · Falco |
| Setup | bind() with authencesn AEAD string | Sigma Rule 2 (keyword) · auditd afalg_bind |
| Exploit trigger | splice() to AF_ALG fd | auditd splice_syscall · Falco/eBPF |
| Post-condition | EBADMSG recv() from unprivileged process | Syscall chain correlation · auditd |
| Impact | /etc/passwd FIM alert + access spike | File integrity monitoring · /proc/<pid>/fd |
| Privilege transition | su execution after AF_ALG activity | Sigma Rule 3 · auditd execve · PAM logs |
