Linux algif_aead Module Mitigation (CVE-2026-31431)

Elgonad .@elgonad

•updated Apr 30, 2026•4•0•394

This rule detects commands executed on Linux systems to mitigate the 'Copy Fail' vulnerability (CVE-2026-31431) related to the 'algif_aead' kernel module. It specifically looks for the dynamic unloading of the module using 'rmmod algif_aead' or the configuration of 'modprobe' to prevent the module from loading by setting 'install algif_aead /bin/false' in a modprobe configuration file.