This detection analyzes Linux auditd syscall failures for socket() with a1=3 (SOCK_RAW) that return exit -97 (EAFNOSUPPORT) and originate from a user-writable path. Such events can indicate an attempt to trigger kernel module loading via request_module() for an unregistered address family, a hallmark of vhost-vsock privilege-escalation exploits on vulnerable kernels. The rule focuses on failed raw-socket creations (a1=3, success=0, exit="-97"), and constrains the source process to executables located under user-writable directories (e.g., /dev/shm/*, /home/*, /run/user/*, /tmp/*, /var/tmp/*). By grouping on auid, uid, host (dest) and session ID, it supports tracking repeated attempts and correlating with the user context. The search is complemented by drilldown queries to view results for a given destination and to assess risk events for the host, flagging potential kernel-exploit-trigger activity. The rule is linked to CVE-2026-74580 and MITRE ATT&CK technique T1068 (Exploitation for Privilege Escalation).