Suspicious Python AF_ALG Socket Creation (CVE-2026-31431)

Bryant Smith@flowstate

•updated Apr 30, 2026•9•0•473

Detects the creation of AF_ALG (kernel crypto API) sockets from Python processes or processes explicitly referencing the 'authencesn' cryptographic template. This behavior is heavily associated with the "Copy Fail" (CVE-2026-31431) local privilege escalation exploit, which uses a Python script to chain AF_ALG and splice() to overwrite page cache pages.