CVE-2026-31431 "Copy Fail" — IR Playbook & Detection Package

Production-ready IR playbook, detection rules, and SOC triage guidance for CVE-2026-31431 — a Linux kernel local privilege escalation in the algif_aead crypto interface. Includes an interactive HTML playbook, Sigma rules, auditd configs, Falco container rules, Wazuh correlation rules, YARA signatures, eBPF real-time monitors, and SIEM hunt queries across Splunk, Sentinel KQL, Elastic EQL, and QRadar AQL.

No exploit code — purely defensive content for SOC analysts and detection engineers.

Author: Ashok Reddy

---

⚠️ Critical: RHEL-Family Mitigation Failure

The widely recommended modprobe blacklist does not work on RHEL, CentOS, AlmaLinux, Rocky Linux, or CloudLinux. The algif_aead module is compiled directly into the kernel (CONFIG_CRYPTO_USER_API_AEAD=y). The commands run without errors but leave the system completely unprotected.

Correct mitigation for RHEL-family:

grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"
reboot
# Verify:
cat /proc/cmdline | grep initcall_blacklist

See mitigate/ for platform-specific scripts.

---

Vulnerability Summary

Field	Detail
CVE	CVE-2026-31431
Nickname	Copy Fail
Component	Linux kernel algif_aead (AF_ALG crypto interface)
Type	Local Privilege Escalation (LPE)
CVSS	7.8 (HIGH)
Primitive	Deterministic 4-byte write into any readable file's page cache
Exploit size	732 bytes Python (standard library only, Python 3.10+)
Reliability	100% — no race condition, no retries
Disk writes	Zero — page-cache only, invisible to FIM tools
Scope	Every major Linux distro since 2017 (kernel 4.13–6.18)
Container risk	Container-escape primitive if host kernel unpatched (T1611)
PoC status	Public since 29 April 2026
Patch	Commit a664bf3d603d — reverts in-place AEAD operations
Discovered by	Taeyang Lee (Theori) · Exploit chain by Xint Code (AI-assisted)

---

Repository Structure

├── README.md                      # This file
├── LICENSE                        # MIT License
├── playbook/
│   ├── index.html                 # Interactive IR Playbook (13 tabs)
│   └── triage_playbook.md         # SOC analyst triage guide
├── sigma/
│   ├── afalg_socket_creation.yml  # AF_ALG socket by non-root
│   ├── afalg_bind_aead_string.yml # authencesn algorithm string
│   └── afalg_splice_chain.yml     # Behavioral chain rule
├── auditd/
│   └── cve-2026-31431.rules       # Complete auditd ruleset
├── falco/
│   └── afalg_container.yml        # Container AF_ALG detection
├── wazuh/
│   └── cve-2026-31431.xml         # Wazuh correlation rules
├── yara/
│   └── copyfail_artifacts.yar     # PoC file artifact detection
├── ebpf/
│   └── copyfail_monitor.bt        # bpftrace real-time monitor
├── queries/
│   ├── splunk.spl                 # Splunk SPL hunt queries
│   ├── defender_sentinel.kql      # Sentinel/MDE KQL queries
│   ├── elastic.eql                # Elastic EQL sequences
│   └── qradar.aql                 # QRadar AQL queries
├── mitigate/
│   ├── mitigate_debian.sh         # Debian/Ubuntu mitigation
│   └── mitigate_rhel.sh           # RHEL-family (grubby method)
└── check/
    └── is_vulnerable.sh           # Safe vulnerability check

---

Interactive IR Playbook

The playbook/index.html is a full interactive playbook with 13 tabs:

Tab	Content
Overview	Attack graph, exploit chain, stats
Phases 1–6	Complete IR lifecycle with checklists
Intel Feed	SOC detection methodology, VAPT vs SOC, community tools, patch status
IOCs	Syscall, process, filesystem, behavioral indicators
MITRE ATT&CK	Technique mapping with detection signals
Detection Use Cases	8 TTP-based use cases (UC-CF-001 through UC-CF-008)
SIEM Hunting	18 queries across all platforms
AI Detection	UEBA/ML capabilities and limitations

Live: https://ashok523.github.io/cve-2026-31431/

---

Detection Coverage

Stage	Detection	Tool
AF_ALG socket by non-root	Sigma · auditd · Falco · eBPF	Primary signal
splice() chain (same PID, 10s)	auditd · eBPF	Near-zero FP
authencesn AEAD string	Sigma · auditd	Critical if observed
uid→euid=0 without auth	auditd · Splunk · KQL	LPE confirmed
su with missing username	auth.log (Wiz signal)	Post-exploitation
PoC on filesystem	YARA	Staging detection
Container escape	Falco with K8s context	T1611
Post-root persistence	auditd FIM · Wazuh	SSH keys, SUID, cron

---

Alert Noise Reduction

Approach	Volume	Confidence
❌ Alert on all splice()	~10,000/hr	Very Low
⚠️ Alert on socket(AF_ALG) alone	~5–50/day	Medium
✅ AF_ALG + splice same PID/10s	~0–2/day	Very High
✅ AF_ALG + splice + su / 60s	~0/day	Critical

---

Quick Start

# 1. Check if vulnerable
sudo bash check/is_vulnerable.sh

# 2. Apply mitigation
sudo bash mitigate/mitigate_rhel.sh    # RHEL-family
sudo bash mitigate/mitigate_debian.sh  # Debian/Ubuntu

# 3. Deploy auditd rules
sudo cp auditd/cve-2026-31431.rules /etc/audit/rules.d/
sudo augenrules --load

# 4. Deploy Wazuh rules
sudo cp wazuh/cve-2026-31431.xml /var/ossec/etc/rules/local_rules.xml
sudo systemctl restart wazuh-manager

# 5. Deploy Falco rule (Kubernetes)
sudo cp falco/afalg_container.yml /etc/falco/rules.d/
sudo systemctl restart falco

# 6. Run eBPF monitor (real-time)
sudo bpftrace ebpf/copyfail_monitor.bt

# 7. Scan for PoC files
yara yara/copyfail_artifacts.yar /tmp/ /dev/shm/ /var/tmp/

---

MITRE ATT&CK Mapping

• T1068 — Exploitation for Privilege Escalation ★
• T1611 — Escape to Host (container)
• T1548.001 — Setuid and Setgid
• T1059.006 — Python execution
• T1027 — Defense Evasion (zero disk writes)
• T1562.001 — Disable/Modify Tools (blacklist removal)
• T1098.004 — SSH Authorized Keys (persistence)
• T1552.001 — Credentials in Files (post-root)

---

Patch Status (2 May 2026)

Distribution	Status	Command
Ubuntu	✅ Patched	apt update && apt install linux-image-generic
AlmaLinux	✅ Patched	dnf clean metadata && dnf upgrade
CloudLinux	✅ Patched + livepatch	kcarectl --update
Debian	✅ Tracked	apt update && apt upgrade
Mainline	✅ Fixed 7.0-rc7	Commit a664bf3d603d
RHEL	⏳ Pending	Errata not yet released
Amazon Linux	🔄 Tracking	yum update kernel

---

References

• copy.fail — Official disclosure
• Xint Code Research — Full technical analysis
• NVD CVE-2026-31431
• Wiz Blog — auth.log detection signal
• Tenable FAQ
• oss-security — Mailing list disclosure

---

Disclaimer

This repository contains defensive detection content only. No exploit code, proof-of-concept scripts, syscall offsets, or shellcode are included or will be added.