Linux Kernel Incorrect Resource Transfer Between Spheres (CVE-2026-31431)

union SecurityEvent, Syslog
| where TimeGenerated > ago(7d)
| where (EventID in (4688, 4689) and (CommandLine has_any ("exploit", "privesc", "lpe")) ) 
    or (Facility =~ "kern" and SyslogMessage has_any ("copy_to_user", "copy_from_user", "__copy_overflow", "kernel memory", "BUG:", "general protection fault", "use-after-free"))
| extend HostCustomEntity = Computer, AccountCustomEntity = Account
| project TimeGenerated, Computer, Account, EventID, CommandLine, SyslogMessage, _ResourceId
| order by TimeGenerated desc

index=linux_logs (sourcetype=syslog OR sourcetype=linux_secure OR sourcetype=linux_audit)
| where (source="/var/log/kern.log" OR source="/var/log/messages" OR source="/dev/log")
    AND (message LIKE "%copy_to_user%" OR message LIKE "%copy_from_user%" OR message LIKE "%__copy_overflow%"
         OR message LIKE "%BUG: unable to handle%" OR message LIKE "%general protection fault%"
         OR message LIKE "%use-after-free%" OR message LIKE "%kernel NULL pointer%"
         OR message LIKE "%out-of-bounds%")
| eval severity_level=case(
    match(message, "BUG:|Oops:|kernel panic"), "critical",
    match(message, "general protection|use-after-free"), "high",
    true(), "medium")
| stats count AS event_count, earliest(_time) AS first_seen, latest(_time) AS last_seen, values(message) AS kernel_messages BY host, severity_level
| where event_count > 0
| sort - last_seen

sequence by host.name with maxspan=5m
  [process where event.type == "start"
    and process.name in ("bash", "sh", "python", "python3", "perl")
    and process.parent.name in ("sshd", "apache2", "nginx", "httpd", "java")]
  [file where event.type in ("creation", "change")
    and file.path like~ "/proc/*/mem" or file.path like~ "/dev/mem"
    or file.path like~ "/sys/kernel/*"]
  [process where event.type == "start"
    and user.name == "root"
    and process.parent.user.name != "root"]

SELECT DATEFORMAT(starttime,'YYYY-MM-dd HH:mm:ss') AS 'Event Time', sourceip AS 'Source IP', username AS 'Username', QIDNAME(qid) AS 'Event Name', LOGSOURCENAME(logsourceid) AS 'Log Source', UTF8(payload) AS 'Raw Event'
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Linux OS', 'Syslog', 'Linux Audit')
AND (UTF8(payload) ILIKE '%copy_to_user%'
  OR UTF8(payload) ILIKE '%copy_from_user%'
  OR UTF8(payload) ILIKE '%__copy_overflow%'
  OR UTF8(payload) ILIKE '%general protection fault%'
  OR UTF8(payload) ILIKE '%use-after-free%'
  OR UTF8(payload) ILIKE '%kernel NULL pointer dereference%'
  OR UTF8(payload) ILIKE '%BUG: unable to handle%')
AND starttime > NOW() - 604800000
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=linux/syslog OR _sourceCategory=linux/kernel OR _sourceCategory=linux/audit
| where _raw matches /copy_to_user|copy_from_user|__copy_overflow|general protection fault|use-after-free|kernel NULL pointer|BUG: unable to handle|out-of-bounds write/
| parse regex "(?<kernel_function>copy_to_user|copy_from_user|__copy_overflow)" nodrop
| parse regex "kernel: (?<kernel_message>[^\n]+)" nodrop
| timeslice 5m
| count by _timeslice, _sourceHost, kernel_function, kernel_message
| order by _timeslice desc

rule cve_2026_31431_linux_kernel_resource_transfer {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects exploitation of CVE-2026-31431 Linux Kernel Incorrect Resource Transfer"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-31431"

  events:
    ($e.metadata.event_type = "PROCESS_UNCATEGORIZED" or
     $e.metadata.event_type = "STATUS_UPDATE")
    and $e.principal.platform = "LINUX"
    and (
      re.regex($e.principal.process.command_line, `copy_to_user|copy_from_user|__copy_overflow`) or
      re.regex($e.target.resource.name, `/proc/[0-9]+/mem|/dev/mem`) or
      re.regex($e.metadata.description, `general protection fault|use-after-free|BUG: unable to handle|kernel NULL pointer`)
    )

  condition:
    $e
}

DeviceProcessEvents
| filter platform_name == "Linux"
| filter (
    (ImageFileName in ("/bin/bash", "/bin/sh", "/usr/bin/python3", "/usr/bin/perl", "/usr/bin/python"))
    and (ParentBaseFileName in ("sshd", "apache2", "httpd", "nginx", "java", "node"))
  )
  or (
    CommandLine matches /\/proc\/[0-9]+\/mem|\/dev\/mem|\/sys\/kernel/
  )
| join kind=inner (
    DeviceEvents
    | filter ActionType == "PrivilegeEscalationDetected" or ActionType == "SuspiciousKernelAccess"
    | filter platform_name == "Linux"
  ) on DeviceId, bin(Timestamp, 5m)
| project Timestamp, DeviceId, DeviceName, AccountName, ImageFileName, CommandLine, ParentBaseFileName, ActionType
| sort by Timestamp desc