algif_aead Module Disablement (CVE-2026-31431 Mitigation)

Elgonad .@elgonad

•updated Apr 30, 2026•2•0•413

Detects commands used to disable or unload the 'algif_aead' kernel module. This activity is the recommended emergency mitigation for the "Copy Fail" vulnerability (CVE-2026-31431). Monitoring this ensures visibility into mitigation deployment across infrastructure and helps identify unauthorized tampering with kernel cryptographic capabilities.