CVE-2026-31431: Linux Kernel Algif_aead In-Place Operation Vulnerability Reverted
CVE-2026-31431 Published on April 22, 2026
crypto: algif_aead - Revert to operating out-of-place
In the Linux kernel, the following vulnerability has been resolved:
crypto: algif_aead - Revert to operating out-of-place
This mostly reverts commit 72548b093ee3 except for the copying of
the associated data.
There is no benefit in operating in-place in algif_aead since the
source and destination come from different mappings. Get rid of
all the complexity added for in-place operation and just copy the
AD directly.
Known Exploited Vulnerability
This Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.
The following remediation steps are recommended / required by May 15, 2026: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vulnerability Analysis
CVE-2026-31431 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. This vulnerability is known to be actively exploited by threat actors. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Types
Incorrect Resource Transfer Between Spheres
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
Improper Validation of Consistency within Input
The product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.
Products Associated with CVE-2026-31431
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-31431 are published in these products:
Affected Versions
Linux:- Version 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 and below 893d22e0135fa394db81df88697fba6032747667 is affected.
- Version 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 and below 19d43105a97be0810edbda875f2cd03f30dc130c is affected.
- Version 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 and below 961cfa271a918ad4ae452420e7c303149002875b is affected.
- Version 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 and below 3115af9644c342b356f3f07a4dd1c8905cd9a6fc is affected.
- Version 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 and below 8b88d99341f139e23bdeb1027a2a3ae10d341d82 is affected.
- Version 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 and below fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8 is affected.
- Version 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 and below ce42ee423e58dffa5ec03524054c9d8bfd4f6237 is affected.
- Version 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 and below a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5 is affected.
- Version 4.14 is affected.
- Before 4.14 is unaffected.
- Version 5.10.254, <= 5.10.* is unaffected.
- Version 5.15.204, <= 5.15.* is unaffected.
- Version 6.1.170, <= 6.1.* is unaffected.
- Version 6.6.137, <= 6.6.* is unaffected.
- Version 6.12.85, <= 6.12.* is unaffected.
- Version 6.18.22, <= 6.18.* is unaffected.
- Version 6.19.12, <= 6.19.* is unaffected.
- Version 7.0, <= * is unaffected.
- Version V3.1.5 and below * is affected.
- Version V3.1.5 and below * is affected.
- Version V3.1.5 and below * is affected.
- Version V3.1.5 and below * is affected.
- Before * is affected.
- Version V3.1.5 and below * is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.