Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator

title: Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator
id: 474b415a-8b3d-4e6a-9f12-0d5c8a7b6e94
status: experimental
description: |
    Detects creation of AF_ALG (Address Family 38) sockets via the socket() syscall.
    AF_ALG is the Linux kernel crypto API interface. It is exploited in CVE-2026-31431
    to achieve local privilege escalation via a buffer overflow in the AF_ALG AEAD
    splice path that corrupts the page cache of SUID binaries.
    Legitimate AF_ALG usage is rare and confined to specific crypto utilities and VPN
    daemons using non-default kernel offload configurations.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-31431
    - https://man7.org/linux/man-pages/man2/socket.2.html
    - https://www.kernel.org/doc/html/latest/crypto/userspace-if.html
    - https://xint.io/blog/copy-fail-linux-distributions
    - https://github.com/theori-io/copy-fail-CVE-2026-31431
    - https://github.com/torvalds/linux/blob/81d6f7807536a0436dfada07e9292e3702d2bed4/include/linux/socket.h#L245
author: Gene Kazimiarovich
date: 2026-04-30
tags:
    - attack.privilege-escalation
    - attack.t1068
    - detection.emerging-threats
    - cve.2026-31431
logsource:
    product: linux
    service: auditd
    definition: |
        Required auditd configuration:
        auditctl -a always,exit -F arch=b64 -S socket -k af_alg_detect
detection:
    selection:
        type: 'SYSCALL'
        SYSCALL: 'socket'
        a0: 26  # auditd SYSCALL args are commonly logged in hex; 0x26 == 38 (AF_ALG)
    filter_main_legitimate:
        exe|endswith:
            - '/cryptsetup'
            - '/kcapi-speed'
            - '/kcapi-enc'
            - '/kcapi-dgst'
            - '/charon'
            - '/charon-systemd'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Disk encryption utilities using kernel crypto offload (cryptsetup with --use-kernel-crypto)
    - Libkcapi userspace tools for kernel crypto API benchmarking
    - StrongSwan IKE daemon with kernel-libipsec plugin
level: high