vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-31431

crypto: algif_aead - Revert to operating out-of-place

HIGH
7.8
CVSS Score
Published: April 22, 2026 at 08:15 AM UTC
Updated: October 15, 2026 at 01:16 AM UTC
83 products affected across 10 vendorsLinux KernelDebian LinuxUbuntu Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.8
Exploitation
CISA KEV
Exploit prediction
EPSS 98%
SSVC
Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score98.1%

EPSS (Exploit Prediction Scoring System) estimates a 98.1% chance this CVE is exploited in the wild within the next 30 days — higher than 100% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.

Required Action
"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware Use
Unknown
Added to KEV
May 1, 2026
Remediation Due
May 15, 2026
164 days overdue
Notes
https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/
https://xint.io/blog/copy-fail-linux-distributions#the-fix-6
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/about/
https://nvd.nist.gov/vuln/detail/CVE-2026-31431

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Amazon Linux· Amazon
95%
All versions
Cloudvision Agni· Arista
95%
2024.4.0 ≤ v ≤ 2025.2.2
Cloudvision Portal· Arista
95%
2024.2.0 ≤ v ≤ 2026.1.0
Netvisor OS· Arista
95%
v < 7.1.07.1.07.1.0 hotfix7
Affected range stops below 7.1.0, so it looks safe — our inference, not a vendor statement
Velocloud Edge· Arista
95%
4.5.0 ≤ v ≤ 6.4.1
Velocloud Gateway· Arista
95%
All versions
Velocloud Orchestrator· Arista
95%
All versions
Ubuntu Linux· Canonicalrubygems
95%
14.0416.0418.0420.0422.0424.0425.10
Debian Linux· Debiandrupal
95%
11.012.013.0
Linux Kernel· Linux
95%
4.14 ≤ v < 5.10.2544.14 ≤ v < 5.15.2044.14 ≤ v < 6.1.1704.14 ≤ v < 6.12.854.14 ≤ v < 6.18.224.14 ≤ v < 6.19.124.14 ≤ v < 6.6.1374.14 ≤ v < 7.05.11 ≤ v < 5.15.2045.16 ≤ v < 6.1.1706.13 ≤ v < 6.18.226.19 ≤ v < 6.19.126.2 ≤ v < 6.6.1376.7 ≤ v < 6.12.857.0 rc17.0 rc27.0 rc37.0 rc47.0 rc57.0 rc672548b093ee38a6d4f2a19e6ef1948ae05c181f7
Vendor states this is fixed in 19d43105a97be0810edbda875f2cd03f30dc130c (fixed)
Vendor states this is fixed in 3115af9644c342b356f3f07a4dd1c8905cd9a6fc (fixed)
Vendor states this is fixed in 893d22e0135fa394db81df88697fba6032747667 (fixed)
Vendor states this is fixed in 8b88d99341f139e23bdeb1027a2a3ae10d341d82 (fixed)
Vendor states this is fixed in 961cfa271a918ad4ae452420e7c303149002875b (fixed)
Vendor states this is fixed in a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5 (fixed)
Vendor states this is fixed in ce42ee423e58dffa5ec03524054c9d8bfd4f6237 (fixed)
Vendor states this is fixed in fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8 (fixed)
Vendor states this is fixed in 4.14 (unaffected)
Vendor states this is fixed in 5.10.254 (unaffected)
Vendor states this is fixed in 5.15.204 (unaffected)
Vendor states this is fixed in 6.1.170 (unaffected)
Vendor states this is fixed in 6.12.85 (unaffected)
Vendor states this is fixed in 6.18.22 (unaffected)
Vendor states this is fixed in 6.19.12 (unaffected)
Vendor states this is fixed in 6.6.137 (unaffected)
Vendor states this is fixed in 7.0 (unaffected)

References (127)

Patch
Source: cverecord
https://git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8
Patch
Source: cverecord
https://git.kernel.org/stable/c/ce42ee423e58dffa5ec03524054c9d8bfd4f6237
Patch
Source: cverecord
https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5
Patch
Source: cverecord
https://git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667
Patch
Source: cverecord
https://git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130c
Patch
Source: cverecord
https://git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875b
Patch
Source: cverecord
https://git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fc
Patch
Source: cverecord
https://git.kernel.org/stable/c/8b88d99341f139e23bdeb1027a2a3ae10d341d82

SSVC — Action Prioritization

SSVCActiveNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGH416baaa9-dc9f-4396-8d5f-8c081fb06d67
Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-669CWE-1288

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card