{"id":"CVE-2026-31431","kind":"vulnerability","aliases":["CVE-2026-31431"],"related":[],"title":"In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating…","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from different mappings.  Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly.","summary":"The Linux kernel has an incorrect resource transfer between spheres flaw that allows privilege escalation. A local user with access to the machine can gain higher privileges, such as root, by abusing it.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2026-05-01T00:00:00+00:00","products":[{"name":"linux kernel","fixed":["5.10.254"],"affected":">= 4.14, < 5.10.254","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.15.204"],"affected":">= 5.11, < 5.15.204","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.1.170"],"affected":">= 5.16, < 6.1.170","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.6.137"],"affected":">= 6.2, < 6.6.137","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.12.85"],"affected":">= 6.7, < 6.12.85","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.18.22"],"affected":">= 6.13, < 6.18.22","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.19.12"],"affected":">= 6.19, < 6.19.12","ecosystem":"vendor"},{"name":"linux kernel","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat openshift container platform","fixed":["4.12.89"],"affected":">= 4.12, < 4.12.89","ecosystem":"vendor"},{"name":"redhat openshift container platform","fixed":["4.13.66"],"affected":">= 4.13, < 4.13.66","ecosystem":"vendor"},{"name":"redhat openshift container platform","fixed":["4.14.65"],"affected":">= 4.14, < 4.14.65","ecosystem":"vendor"},{"name":"redhat openshift container platform","fixed":["4.15.64"],"affected":">= 4.15, < 4.15.64","ecosystem":"vendor"},{"name":"redhat openshift container platform","fixed":["4.16.61"],"affected":">= 4.16, < 4.16.61","ecosystem":"vendor"},{"name":"redhat openshift container platform","fixed":["4.17.53"],"affected":">= 4.17, < 4.17.53","ecosystem":"vendor"},{"name":"redhat openshift container platform","fixed":["4.18.40"],"affected":">= 4.18, < 4.18.40","ecosystem":"vendor"},{"name":"redhat openshift container platform","fixed":["4.19.30"],"affected":">= 4.19, < 4.19.30","ecosystem":"vendor"},{"name":"redhat openshift container platform","fixed":["4.20.21"],"affected":">= 4.20, < 4.20.21","ecosystem":"vendor"},{"name":"redhat openshift container platform","fixed":["4.21.14"],"affected":">= 4.21, < 4.21.14","ecosystem":"vendor"},{"name":"redhat openshift container platform","fixed":[],"affected":"= 4.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"redhat enterprise linux aus","fixed":[],"affected":"= 8.4","ecosystem":"vendor"},{"name":"redhat enterprise linux aus","fixed":[],"affected":"= 8.6","ecosystem":"vendor"},{"name":"redhat enterprise linux eus","fixed":[],"affected":"= 8.4","ecosystem":"vendor"},{"name":"redhat enterprise linux eus","fixed":[],"affected":"= 9.4","ecosystem":"vendor"},{"name":"redhat enterprise linux eus","fixed":[],"affected":"= 9.6","ecosystem":"vendor"},{"name":"redhat enterprise linux eus","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"redhat enterprise linux tus","fixed":[],"affected":"= 8.6","ecosystem":"vendor"},{"name":"redhat enterprise linux tus","fixed":[],"affected":"= 8.8","ecosystem":"vendor"},{"name":"redhat enterprise linux update services for sap solutions","fixed":[],"affected":"= 8.6","ecosystem":"vendor"},{"name":"redhat enterprise linux update services for sap solutions","fixed":[],"affected":"= 8.8","ecosystem":"vendor"},{"name":"redhat enterprise linux update services for sap solutions","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"redhat enterprise linux update services for sap solutions","fixed":[],"affected":"= 9.2","ecosystem":"vendor"},{"name":"amazon linux","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 12.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 13.0","ecosystem":"vendor"},{"name":"opensuse leap","fixed":[],"affected":"= 15.3","ecosystem":"vendor"},{"name":"Linux Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","kubernetes","linux","poc-public","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the vendor kernel mitigations or update to a fixed kernel build from your distribution; CISA says to follow vendor instructions or discontinue use if mitigations are unavailable.","status":"open","published_at":"2026-04-22T09:16:21+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:38:37+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:38:37Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor kernel mitigations or update to a fixed kernel build from your distribution; CISA says to follow vendor instructions or discontinue use if mitigations are unavailable.","reach":"local","summary":"The Linux kernel has an incorrect resource transfer between spheres flaw that allows privilege escalation. A local user with access to the machine can gain higher privileges, such as root, by abusing it.","category":"infrastructure","who_cares":["linux","self-hosted","kubernetes"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user gains root and can read secrets or take over the host","analyst_note":"Find the affected kernel version ranges and fixed builds from the vendor or distro advisories, and check the KEV entry and the PoC repo for exact conditions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00043,"input_tokens":2563,"output_tokens":347,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,21A '-31431':19A,22A '72548b093ee3':237C 'abus':212B 'access':200B 'ad':283C 'add':273C 'aead':13A,225C,257C 'algif':12A,224C,256C 'allow':193B 'amazon':156A 'associ':244C 'aus':95A,99A 'benefit':249C 'canonical':158A 'come':263C 'commit':236C 'complex':272C 'container':41A,45A,49A,53A,57A,61A,65A,69A,73A,77A,81A 'copi':241C,281C 'crypto':11A,223C 'cve':17A,20A 'data':245C 'debian':161A,163A,165A 'destin':262C 'differ':265C 'direct':284C 'enterprise':84A,87A,90A,93A,97A,101A,105A,109A,113A,117A,121A,125A,133A,141A,149A 'escal':195B 'eus':103A,107A,111A,115A 'except':238C 'exploit':171B 'flaw':191B 'follow':6A,218C 'for':129A,137A,145A,153A 'gain':205B 'get':267C 'higher':206B 'host':180B 'in-plac':252C,275C 'incorrect':186B 'infrastructur':172B 'kernel':4A,24A,26A,28A,30A,32A,34A,36A,38A,170A,183B,216C 'kubernet':173B 'leap':168A 'linux':3A,23A,25A,27A,29A,31A,33A,35A,37A,85A,88A,91A,94A,98A,102A,106A,110A,114A,118A,122A,126A,134A,142A,150A,157A,160A,162A,164A,166A,169A,174B,182B,215C 'local':197B 'machin':203B 'map':266C 'most':234C 'openshift':40A,44A,48A,52A,56A,60A,64A,68A,72A,76A,80A 'opensuse':167A 'oper':16A,228C,251C,278C 'out-of-plac':229C 'place':232C,254C,277C 'platform':42A,46A,50A,54A,58A,62A,66A,70A,74A,78A,82A 'poc':176B 'poc-publ':175B 'privileg':194B,207B 'public':177B 'redhat':39A,43A,47A,51A,55A,59A,63A,67A,71A,75A,79A,83A,86A,89A,92A,96A,100A,104A,108A,112A,116A,120A,124A,132A,140A,148A 'resolv':10A,222C 'resourc':187B 'revert':14A,226C,235C 'rid':268C 'root':210B 'sap':130A,138A,146A,154A 'self':179B 'self-host':178B 'services':128A,136A,144A,152A 'sinc':258C 'solutions':131A,139A,147A,155A 'sourc':260C 'sphere':190B 'transfer':188B 'tus':119A,123A 'ubuntu':159A 'update':127A,135A,143A,151A 'user':198B 'vulner':7A,219C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-22T09:16:21+00:00","kev":{"dateAdded":"2026-05-01","dueDate":"2026-05-15","requiredAction":"\"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2026-31431","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-31431","severity":null,"published_at":"2026-05-01T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:45+00:00","note":null},{"source":"github-poc","external_id":"StackOverflowExcept1on/CVE-2026-31431","url":"https://github.com/StackOverflowExcept1on/CVE-2026-31431","severity":null,"published_at":"2026-10-23T08:21:40+00:00","modified_at":null,"first_seen_at":"2026-10-23T20:22:16+00:00","fetched_at":"2026-10-23T20:22:16+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-31431","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31431","severity":null,"published_at":"2026-04-22T09:16:21+00:00","modified_at":"2026-09-08T15:13:07+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[{"id":680,"url":"https://github.com/StackOverflowExcept1on/CVE-2026-31431","title":"StackOverflowExcept1on/CVE-2026-31431","kind":"poc","source":"github","text":"Copy Fail exploit for Ubuntu 20.04 with legacy Python versions, including script to hide Copy Fail.\n\nstars 0","published_at":"2026-10-23T08:21:40+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}