Add detection rules for CVE-2026-31431 (CopyFail)

[tjs24]

Summary of the Pull Request

Adds three high-fidelity auditd-based Sigma rules detecting exploitation of CVE-2026-31431 ("CopyFail") — a Linux kernel local privilege escalation in the algif_aead userspace crypto interface (AF_ALG socket family). The flaw allows an unprivileged caller to perform a controlled 4-byte write into the page cache of any readable file, typically corrupting the in-memory copy of a setuid binary such as /usr/bin/su to inherit root. It affects all mainstream distros shipping a stock kernel since 2017 (Ubuntu, RHEL, Debian, SUSE, AlmaLinux, Amazon Linux).

The three rules cover three independent points in the exploit chain so an analyst gets corroborating signals even if one stage is missed in the indexed window:

File	Logsource	Stage	Level
lnx_auditd_exploit_cve_2026_31431_af_alg_socket.yml	linux/auditd	AF_ALG socket creation outside the cryptsetup/kcapi/fscrypt toolchain	medium
lnx_auditd_exploit_cve_2026_31431_algif_aead_module_load.yml	linux/auditd	Explicit modprobe/insmod/kmod load of algif_aead	medium
lnx_auditd_exploit_cve_2026_31431_splice_to_af_alg.yml	linux/auditd	splice() syscall paired with PATH record for a setuid binary, by auid!=0	high

References used for each rule are embedded in the YAML and span Palo Alto Unit 42, Microsoft, Wiz, Sysdig, secwest.net, Xint, oss-security and the Ubuntu advisory.

Local validation passes for: yamllint --strict, sigma check --fail-on-error --fail-on-issues (pysigma + pySigma-validators-sigmahq 0.20), tests/test_logsource.py, tests/test_rules.py, and the duplicate-id grep.

Changelog

new: AF_ALG Crypto Socket Creation Outside Disk-Encryption Toolchain - Potential CVE-2026-31431 Exploitation
new: algif_aead Kernel Module Load - Potential CVE-2026-31431 Pre-Exploitation
new: Splice Syscall Accessing Setuid Binary Path - Potential CVE-2026-31431 Exploitation

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

[tjs24]

hey @swachchhanda000 since this is based on a CVE, let me know how i should provide the log for verification.

[swachchhanda000]

hey @swachchhanda000 since this is based on a CVE, let me know how i should provide the log for verification.

Yeah, logs would be nice to have.

[tjs24]

Sure, here's the evidence log captured on Amazon Linux 2023 with the audit rules from each rule's definition: block loaded. Replication runbook: https://github.com/tjs24/ThIOClaw/blob/main/runbooks/CVE-2026-31431_sigma_validation.md

Rule 1:

type=SYSCALL msg=audit(1780951806.263:682): arch=c000003e syscall=41 success=yes exit=3 a0=26 a1=80005 a2=0 a3=7f99683f0abc items=0 ppid=27605 pid=27606 auid=1000 uid=1001 gid=1001 euid=1001 tty=pts1 ses=1 comm="python3.11" exe="/usr/bin/python3.11" key="af_alg"

Rule 2:

type=EXECVE msg=audit(1780951812.763:700): argc=2 a0="modprobe" a1="algif_aead"
type=SYSCALL msg=audit(1780951812.763:700): arch=c000003e syscall=59 success=yes exit=0 ppid=27616 pid=27617 auid=1000 uid=0 comm="modprobe" exe="/usr/bin/kmod" key="execve_all"

Rule 3 (PATH lives on the preceding openat(), not the splice() — rule's definition: documents the PATH→SYSCALL stitching requirement):

type=PATH    msg=audit(1780951819.573:710): item=0 name="/usr/bin/su" mode=0104755 ouid=0 ogid=0 obj=system_u:object_r:su_exec_t:s0 nametype=NORMAL
type=SYSCALL msg=audit(1780951819.573:710): arch=c000003e syscall=257 success=yes exit=5 items=1 ppid=27622 pid=27623 auid=1000 uid=1001 comm="python3.11" exe="/usr/bin/python3.11" key="su_read"
type=SYSCALL msg=audit(1780951819.573:711): arch=c000003e syscall=275 success=yes exit=8 a0=5 a1=0 a2=4 a3=0 items=0 ppid=27622 pid=27623 auid=1000 uid=1001 comm="python3.11" exe="/usr/bin/python3.11" key="copyfail_splice"

[tjs24]

hey @swachchhanda000 added the relevant logs and link to log reproduction steps.