[ 24.365791] NET: Registered PF_ALG protocol family [ 24.383637] alg: No test for authencesn(hmac(sha256),cbc(aes)) (authencesn(hmac(sha256-ni),cbc-aes-aesni)) [ 24.386115] process 'su' launched '/bin/sh' with NULL argv: empty string added

Notices where this attachment appears

1. Embed this notice
   Will Dormann (wdormann@infosec.exchange)'s status on Friday, 01-May-2026 04:39:21 JST Will Dormann

   in reply to

   If you're curious about IOCs for copyfail, look in syslog for:
   NET: Registered PF_ALG protocol family
   for attempts to exploit copyfail on systems that use the vulnerable code as a module. For systems that have the vulnerable code compiled into the kernel, like RHEL, you'll see this line on every boot.
   And at least for this particular flavor of exploit, a wall-clock nearby:
   process 'su' launched '/bin/sh with NULL argv: empty string added`
   is an indication of successful exploitation.

   But it's worth noting that the "process launched" stuff is merely what the ITW PoC will leave behind. More clever exploitation may not be as obvious.