Linux Kernel Dirty Frag & Copy Fail: CVE-2026-31431 & CVE-2026-43284 Hardening

---
title: Linux Kernel Module Load of Vulnerable AEAD Interface
id: 89a2b123-c4d5-4e6f-9a10-112233445566
status: experimental
description: Detects the loading of the algif_aead kernel module, associated with CVE-2026-31431 "Copy Fail". While standard in some setups, manual loading by non-admin users is suspicious.
references:
  - https://ubuntu.com/security/notices/USN-8499-1
author: Security Arsenal
date: 2026/04/14
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: SYSCALL
    syscall: init_module, finit_module
  keywords:
    - 'algif_aead'
  condition: selection and keywords
falsepositives:
  - System administration activities
  - Legitimate cryptographic services starting
level: high
---
title: Linux XFRM State Manipulation via IP Command
id: 77c1d099-b3e4-4d5c-8b21-998877665544
status: experimental
description: Detects commands manipulating XFRM (IPsec) policies or states, relevant to the "Dirty Frag" vulnerabilities in XFRM ESP-in-TCP (CVE-2026-43284).
references:
  - https://ubuntu.com/security/notices/USN-8499-1
author: Security Arsenal
date: 2026/04/14
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '/ip'
      - '/ip6tables'
    CommandLine|contains:
      - 'xfrm state'
      - 'xfrm policy'
  condition: selection
falsepositives:
  - Authorized VPN configuration changes
  - Network administrator automation
level: medium
---
title: Linux RxRPC Socket Creation
id: 66b0e088-a2d3-4c5b-7a30-887766554433
status: experimental
description: Detects usage of the RxRPC protocol family sockets, associated with the Dirty Frag vulnerability (CVE-2026-43500). Uncommon in standard enterprise workloads.
references:
  - https://ubuntu.com/security/notices/USN-8499-1
author: Security Arsenal
date: 2026/04/14
tags:
  - attack.execution
  - attack.t1106
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: SOCKETCALL
    or:
      - a0: 21  # AF_RXRPC on some archs
      - a1: 21
  filter:
    comm: ['rpcbind', 'systemd']
  condition: selection and not filter
falsepositives:
  - Legitimate AFS or RxRPC applications (rare in standard infra)
level: low

// Hunt for 'ip xfrm' commands indicative of XFRM subsystem interaction
Syslog
| where ProcessName has "ip" 
| where CommandLine has "xfrm" 
| project TimeGenerated, HostName, ProcessName, CommandLine, SourceIP
| order by TimeGenerated desc

// Hunt for kernel module loading events (auditd)
Syslog
| where ProcessName has "auditd" 
| where SyslogMessage has "init_module" or SyslogMessage has "finit_module"
| extend ModuleName = extract(@'(.*)', 1, SyslogMessage) // Adjust regex based on specific audit format
| where ModuleName has "algif_aead"
| project TimeGenerated, HostName, SyslogMessage

-- Check for loaded vulnerable kernel modules and OS version
SELECT 
  OSInfo.Version AS KernelVersion,
  OSInfo.Build AS KernelRelease,
  OSInfo.Hostname AS Hostname
FROM info()

SELECT 
  Name,
  Size,
  UsedBy
FROM grep(filename='/proc/modules', pattern='algif_aead')

SELECT 
  Name,
  Size,
  UsedBy
FROM grep(filename='/proc/modules', pattern='rxrpc')

-- Identify XFRM state changes in audit logs (if available)
SELECT * FROM foreach(
  SELECT * FROM glob(globs='/var/log/audit/audit.log*')
) WHERE Line =~ 'xfrm'

#!/bin/bash
# Security Arsenal - Remediation Script for USN-8499-1
# Addresses CVE-2026-31431 and Dirty Frag CVEs

echo "[+] Checking kernel version..."
uname -r

echo "[+] Checking if vulnerable modules are loaded..."
if lsmod | grep -q 'algif_aead'; then
    echo "[WARNING] algif_aead module is loaded. Mitigation recommended."
    lsmod | grep algif_aead
else
    echo "[INFO] algif_aead module not currently loaded."
fi

if lsmod | grep -q 'rxrpc'; then
    echo "[WARNING] rxrpc module is loaded."
    lsmod | grep rxrpc
else
    echo "[INFO] rxrpc module not currently loaded."
fi

echo "[+] Applying hardening - Blocklisting vulnerable modules..."
# Create a configuration to blocklist the modules
echo "install algif_aead /bin/true" > /etc/modprobe.d/block-usn8499-1.conf
echo "install rxrpc /bin/true" >> /etc/modprobe.d/block-usn8499-1.conf
echo "[+] Modules blocklisted in /etc/modprobe.d/block-usn8499-1.conf"

echo "[!] CRITICAL: Apply USN-8499-1 patches immediately."
echo "Run: sudo apt update && sudo apt upgrade"

# Check if reboot is required
if [ -f /var/run/reboot-required ]; then
    echo "[!] System reboot required to finalize kernel update."
    cat /var/run/reboot-required.pkgs
fi