Skip to content
Threat Feed

Tag

Cve-2026-31431

1 brief RSS
high advisory

Potential Copy Fail (CVE-2026-31431) Exploitation via AF_ALG Socket

This rule detects potential exploitation of CVE-2026-31431, a Copy Fail vulnerability in the Linux kernel, via AF_ALG socket abuse, by correlating non-root AF_ALG-class socket or splice events with a subsequent process execution where the effective user is root but the login user remains non-root, indicating a privilege escalation attempt.

Auditbeat +1 privilege-escalation linux vulnerability cve-2026-31431
2r 2t 1c