Linux Privilege Escalation via CVE-2026-31431 PoC (Copy Fail)

nomit vyas@xoxo

•updated Apr 30, 2026•18•0•974

This rule detects the execution of a Python Proof-of-Concept (PoC) script named 'exp.py' followed by the execution of the 'su' binary within a 5-minute window on a Linux system. This correlation is indicative of an attempt to exploit CVE-2026-31431 (Copy Fail), which leverages AF_ALG sockets to overwrite the 'su' setuid binary in memory, aiming to achieve root privileges.