Vuln: CVE-2026-31431 | Detection.FYI

Potential Copy Fail (CVE-2026-31431) Exploitation via AF_ALG Socket

Sep 19, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Use Case: Vulnerability Tactic: Privilege Escalation Data Source: Auditd Manager Resources: Investigation Guide Noise: Unknown Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Linux Vuln: CVE-2026-31431 ·
Share on:

Correlates a burst of non-root AF_ALG-class "socket", "splice", or "bound-socket" telemetry with a subsequent process execution where effective user is root but the login user remains non-root. This sequence matches common post-exploitation chains for Copy Fail (CVE-2026-31431) style abuse where AF_ALG and "splice" primitives precede executing a corrupted setuid binary from cache.

Read More