Unprivileged AF_ALG Socket Creation (CVE-2026-31431)

Elgonad .@elgonad

•updated Apr 30, 2026•15•0•799

Detects the creation of an AF_ALG socket (address family 38) by a non-root user. This is a highly unusual action and serves as a primary early warning indicator for CVE-2026-31431 (Copy Fail) exploitation attempts.