Sigma rule: Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator

Rule

Title

Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator

Status

experimental

Level

high

Author

Gene Kazimiarovich

Date

2026-04-30

File

rules-emerging-threats/2026/Exploits/CVE-2026-31431/lnx_auditd_exploit_cve_2026_31431_af_alg_socket_creation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects creation of AF_ALG (Address Family 38) sockets via the socket() syscall.
AF_ALG is the Linux kernel crypto API interface. It is exploited in CVE-2026-31431
to achieve local privilege escalation via a buffer overflow in the AF_ALG AEAD
splice path that corrupts the page cache of SUID binaries.
Legitimate AF_ALG usage is rare and confined to specific crypto utilities and VPN
daemons using non-default kernel offload configurations.

Log source

product

linux

service

auditd

definition

Required auditd configuration: auditctl -a always,exit -F arch=b64 -S socket -k af_alg_detect

Detection

selection:
    type: 'SYSCALL'
    SYSCALL: 'socket'
    a0: 26  # auditd SYSCALL args are commonly logged in hex; 0x26 == 38 (AF_ALG)
filter_main_legitimate:
    exe|endswith:
        - '/cryptsetup'
        - '/kcapi-speed'
        - '/kcapi-enc'
        - '/kcapi-dgst'
        - '/charon'
        - '/charon-systemd'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Disk encryption utilities using kernel crypto offload (cryptsetup with --use-kernel-crypto)
• Libkcapi userspace tools for kernel crypto API benchmarking
• StrongSwan IKE daemon with kernel-libipsec plugin

Tags

• attack.privilege-escalation
• attack.t1068
• detection.emerging-threats
• cve.2026-31431

CVEs this rule names

• CVE-2026-31431

MITRE ATT&CK ids this rule names

• T1068

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-31431
• https://man7.org/linux/man-pages/man2/socket.2.html
• https://www.kernel.org/doc/html/latest/crypto/userspace-if.html
• https://xint.io/blog/copy-fail-linux-distributions
• https://github.com/theori-io/copy-fail-CVE-2026-31431
• https://github.com/torvalds/linux/blob/81d6f7807536a0436dfada07e9292e3702d2bed4/include/linux/socket.h#L245

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2026/Exploits/CVE-2026-31431/lnx_auditd_exploit_cve_2026_31431_af_alg_socket_creation.yml