Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator

calendar Jul 3, 2026 · attack.privilege-escalation attack.t1068 detection.emerging-threats cve.2026-31431  ·
Share on: linkedin copy

Detects creation of AF_ALG (Address Family 38) sockets via the socket() syscall. AF_ALG is the Linux kernel crypto API interface. It is exploited in CVE-2026-31431 to achieve local privilege escalation via a buffer overflow in the AF_ALG AEAD splice path that corrupts the page cache of SUID binaries. Legitimate AF_ALG usage is rare and confined to specific crypto utilities and VPN daemons using non-default kernel offload configurations.

Sigma rule (View on GitHub)

 1title: Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator
 2id: 474b415a-8b3d-4e6a-9f12-0d5c8a7b6e94
 3status: experimental
 4description: |
 5    Detects creation of AF_ALG (Address Family 38) sockets via the socket() syscall.
 6    AF_ALG is the Linux kernel crypto API interface. It is exploited in CVE-2026-31431
 7    to achieve local privilege escalation via a buffer overflow in the AF_ALG AEAD
 8    splice path that corrupts the page cache of SUID binaries.
 9    Legitimate AF_ALG usage is rare and confined to specific crypto utilities and VPN
10    daemons using non-default kernel offload configurations.    
11references:
12    - https://nvd.nist.gov/vuln/detail/CVE-2026-31431
13    - https://man7.org/linux/man-pages/man2/socket.2.html
14    - https://www.kernel.org/doc/html/latest/crypto/userspace-if.html
15    - https://xint.io/blog/copy-fail-linux-distributions
16    - https://github.com/theori-io/copy-fail-CVE-2026-31431
17    - https://github.com/torvalds/linux/blob/81d6f7807536a0436dfada07e9292e3702d2bed4/include/linux/socket.h#L245
18author: Gene Kazimiarovich
19date: 2026-04-30
20tags:
21    - attack.privilege-escalation
22    - attack.t1068
23    - detection.emerging-threats
24    - cve.2026-31431
25logsource:
26    product: linux
27    service: auditd
28    definition: |
29        Required auditd configuration:
30        auditctl -a always,exit -F arch=b64 -S socket -k af_alg_detect        
31detection:
32    selection:
33        type: 'SYSCALL'
34        SYSCALL: 'socket'
35        a0: 26  # auditd SYSCALL args are commonly logged in hex; 0x26 == 38 (AF_ALG)
36    filter_main_legitimate:
37        exe|endswith:
38            - '/cryptsetup'
39            - '/kcapi-speed'
40            - '/kcapi-enc'
41            - '/kcapi-dgst'
42            - '/charon'
43            - '/charon-systemd'
44    condition: selection and not 1 of filter_main_*
45falsepositives:
46    - Disk encryption utilities using kernel crypto offload (cryptsetup with --use-kernel-crypto)
47    - Libkcapi userspace tools for kernel crypto API benchmarking
48    - StrongSwan IKE daemon with kernel-libipsec plugin
49level: high

References

Related rules

to-top