--- id: "CVE-2026-31431" kind: "vulnerability" aliases: ["CVE-2026-31431"] title: "In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating\u2026" severity: "high" cvss: 7.8 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "linux kernel", "fixed": ["5.10.254"], "affected": ">= 4.14, < 5.10.254", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["5.15.204"], "affected": ">= 5.11, < 5.15.204", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["6.1.170"], "affected": ">= 5.16, < 6.1.170", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["6.6.137"], "affected": ">= 6.2, < 6.6.137", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["6.12.85"], "affected": ">= 6.7, < 6.12.85", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["6.18.22"], "affected": ">= 6.13, < 6.18.22", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["6.19.12"], "affected": ">= 6.19, < 6.19.12", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}, {"name": "redhat openshift container platform", "fixed": ["4.12.89"], "affected": ">= 4.12, < 4.12.89", "ecosystem": "vendor"}, {"name": "redhat openshift container platform", "fixed": ["4.13.66"], "affected": ">= 4.13, < 4.13.66", "ecosystem": "vendor"}, {"name": "redhat openshift container platform", "fixed": ["4.14.65"], "affected": ">= 4.14, < 4.14.65", "ecosystem": "vendor"}, {"name": "redhat openshift container platform", "fixed": ["4.15.64"], "affected": ">= 4.15, < 4.15.64", "ecosystem": "vendor"}, {"name": "redhat openshift container platform", "fixed": ["4.16.61"], "affected": ">= 4.16, < 4.16.61", "ecosystem": "vendor"}, {"name": "redhat openshift container platform", "fixed": ["4.17.53"], "affected": ">= 4.17, < 4.17.53", "ecosystem": "vendor"}, {"name": "redhat openshift container platform", "fixed": ["4.18.40"], "affected": ">= 4.18, < 4.18.40", "ecosystem": "vendor"}, {"name": "redhat openshift container platform", "fixed": ["4.19.30"], "affected": ">= 4.19, < 4.19.30", "ecosystem": "vendor"}, {"name": "redhat openshift container platform", "fixed": ["4.20.21"], "affected": ">= 4.20, < 4.20.21", "ecosystem": "vendor"}, {"name": "redhat openshift container platform", "fixed": ["4.21.14"], "affected": ">= 4.21, < 4.21.14", "ecosystem": "vendor"}, {"name": "redhat openshift container platform", "fixed": [], "affected": "= 4.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 9.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 10.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux aus", "fixed": [], "affected": "= 8.4", "ecosystem": "vendor"}, {"name": "redhat enterprise linux aus", "fixed": [], "affected": "= 8.6", "ecosystem": "vendor"}, {"name": "redhat enterprise linux eus", "fixed": [], "affected": "= 8.4", "ecosystem": "vendor"}, {"name": "redhat enterprise linux eus", "fixed": [], "affected": "= 9.4", "ecosystem": "vendor"}, {"name": "redhat enterprise linux eus", "fixed": [], "affected": "= 9.6", "ecosystem": "vendor"}, {"name": "redhat enterprise linux eus", "fixed": [], "affected": "= 10.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux tus", "fixed": [], "affected": "= 8.6", "ecosystem": "vendor"}, {"name": "redhat enterprise linux tus", "fixed": [], "affected": "= 8.8", "ecosystem": "vendor"}, {"name": "redhat enterprise linux update services for sap solutions", "fixed": [], "affected": "= 8.6", "ecosystem": "vendor"}, {"name": "redhat enterprise linux update services for sap solutions", "fixed": [], "affected": "= 8.8", "ecosystem": "vendor"}, {"name": "redhat enterprise linux update services for sap solutions", "fixed": [], "affected": "= 9.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux update services for sap solutions", "fixed": [], "affected": "= 9.2", "ecosystem": "vendor"}, {"name": "amazon linux", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 11.0", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 12.0", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 13.0", "ecosystem": "vendor"}, {"name": "opensuse leap", "fixed": [], "affected": "= 15.3", "ecosystem": "vendor"}, {"name": "Linux Kernel", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "infrastructure", "kubernetes", "linux", "poc-public", "self-hosted"] not_affected_if: ["unknown"] published_at: "2026-04-22T09:16:21+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-24T00:09:50+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-31431", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "github-poc", "url": "https://github.com/StackOverflowExcept1on/CVE-2026-31431", "first_seen_at": "2026-10-23T20:22:16+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31431", "first_seen_at": "2026-10-23T23:44:51+00:00"}] --- # In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating… The Linux kernel has an incorrect resource transfer between spheres flaw that allows privilege escalation. A local user with access to the machine can gain higher privileges, such as root, by abusing it. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:linux kernel affected >= 4.14, < 5.10.254 fixed 5.10.254 - vendor:linux kernel affected >= 5.11, < 5.15.204 fixed 5.15.204 - vendor:linux kernel affected >= 5.16, < 6.1.170 fixed 6.1.170 - vendor:linux kernel affected >= 6.2, < 6.6.137 fixed 6.6.137 - vendor:linux kernel affected >= 6.7, < 6.12.85 fixed 6.12.85 - vendor:linux kernel affected >= 6.13, < 6.18.22 fixed 6.18.22 - vendor:linux kernel affected >= 6.19, < 6.19.12 fixed 6.19.12 - vendor:linux kernel affected = 7.0 fixed ? - vendor:redhat openshift container platform affected >= 4.12, < 4.12.89 fixed 4.12.89 - vendor:redhat openshift container platform affected >= 4.13, < 4.13.66 fixed 4.13.66 - vendor:redhat openshift container platform affected >= 4.14, < 4.14.65 fixed 4.14.65 - vendor:redhat openshift container platform affected >= 4.15, < 4.15.64 fixed 4.15.64 - vendor:redhat openshift container platform affected >= 4.16, < 4.16.61 fixed 4.16.61 - vendor:redhat openshift container platform affected >= 4.17, < 4.17.53 fixed 4.17.53 - vendor:redhat openshift container platform affected >= 4.18, < 4.18.40 fixed 4.18.40 - vendor:redhat openshift container platform affected >= 4.19, < 4.19.30 fixed 4.19.30 - vendor:redhat openshift container platform affected >= 4.20, < 4.20.21 fixed 4.20.21 - vendor:redhat openshift container platform affected >= 4.21, < 4.21.14 fixed 4.21.14 - vendor:redhat openshift container platform affected = 4.0 fixed ? - vendor:redhat enterprise linux affected = 8.0 fixed ? - vendor:redhat enterprise linux affected = 9.0 fixed ? - vendor:redhat enterprise linux affected = 10.0 fixed ? - vendor:redhat enterprise linux aus affected = 8.4 fixed ? - vendor:redhat enterprise linux aus affected = 8.6 fixed ? - vendor:redhat enterprise linux eus affected = 8.4 fixed ? - vendor:redhat enterprise linux eus affected = 9.4 fixed ? - vendor:redhat enterprise linux eus affected = 9.6 fixed ? - vendor:redhat enterprise linux eus affected = 10.0 fixed ? - vendor:redhat enterprise linux tus affected = 8.6 fixed ? - vendor:redhat enterprise linux tus affected = 8.8 fixed ? - vendor:redhat enterprise linux update services for sap solutions affected = 8.6 fixed ? - vendor:redhat enterprise linux update services for sap solutions affected = 8.8 fixed ? - vendor:redhat enterprise linux update services for sap solutions affected = 9.0 fixed ? - vendor:redhat enterprise linux update services for sap solutions affected = 9.2 fixed ? - vendor:amazon linux affected ? fixed ? - vendor:canonical ubuntu linux affected ? fixed ? - vendor:debian linux affected = 11.0 fixed ? - vendor:debian linux affected = 12.0 fixed ? - vendor:debian linux affected = 13.0 fixed ? - vendor:opensuse leap affected = 15.3 fixed ? - vendor:Linux Kernel affected ? fixed ? ## Fix Apply the vendor kernel mitigations or update to a fixed kernel build from your distribution; CISA says to follow vendor instructions or discontinue use if mitigations are unavailable. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-31431 - 2026-10-23T20:22:16+00:00 github-poc https://github.com/StackOverflowExcept1on/CVE-2026-31431 - 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-31431 ## Documents - [poc] StackOverflowExcept1on/CVE-2026-31431 https://github.com/StackOverflowExcept1on/CVE-2026-31431 ## From the sources In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_