algif_aead Module Mitigation Activity (CVE-2026-31431)

nomit vyas@xoxo

•updated Apr 30, 2026•3•0•460

This rule detects attempts to mitigate the CVE-2026-31431 vulnerability by either unloading the 'algif_aead' kernel module using 'rmmod' or by configuring 'modprobe' to blackhole the 'algif_aead' module. This activity indicates a system administrator or automated tool is applying a known mitigation for a kernel vulnerability.