Dirty Frag Exploit AF_ALG Socket Bind (pcbc(fcrypt))
Detects attempts to bind an AF_ALG socket to the pcbc(fcrypt) cryptographic cipher. The Dirty Frag (CVE-2026-43500) RxRPC exploit variant leverages this highly unusual cryptographic combination to perform offline key brute-forcing in user-space to predict decrypted file offsets. This rule covers eBPF telemetry arguments, standard command-line logging (to catch potential kernel `modprobe` triggers), and auditd SOCKADDR hex-encoded structures.
Sigma
