7.8

CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

KEV
Analyzed
AliasesSUSE-SU-2026:21460-1RHSA-2026:14926RHSA-2026:15976
Published 22-04-2026Last modified 15-10-2026

Vulnerability summary

CVE-2026-31431 is a high (CVSS 7.8) vulnerability in Linux Kernel. It is known to be exploited: CISA and CIRCL list it, first on 01-05-2026. EPSS estimates a 98.11% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 9 public exploits are recorded.

Priority
Act nowlisted as exploited

Listed as exploited by CIRCL (02-05-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
98.11%
0%100%
Critical · +94.68 pp in 30 days
KEVExploited in the wildCritical · listed in 2 catalogs
RansomwareNot flaggedNo ransomware use recorded.
Public exploits9github, reference, metasploit

Advisory lineage

Upstream 0 · Downstream 56 · Related 52

Timeline

  1. 22-04-2026
    PublishedVulnerability first disclosed.
  2. 01-05-2026
    Added to CISA KEVExploitedLinux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
  3. 02-05-2026
    Added to CIRCL KEVExploitedAdded to the CIRCL known exploited vulnerabilities catalog.
  4. 15-05-2026
    CISA remediation dueDeadline passedApply mitigations per vendor instructions.
  5. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

98.11%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

Increase +94.68 pp

From 3.44% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
01-05-2026
Federal due date
15-05-2026
ENISA CNW

Not in the ENISA CNW catalog.

CIRCLListed
Added
02-05-2026

CISA required action

"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/ xint.io/blog/copy-fail-linux-distributions git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/about/ nvd.nist.gov/vuln/detail/CVE-2026-31431

Public exploits

9 found
  • githubUnverified

    Copy Fail Cve 2026 31431

    Maturity: poc

  • referenceUnverified

    Exploit Reference (xint.io)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (openwall.com)

    Maturity: unknown

Show all 9 exploits
  • referenceUnverified

    Exploit Reference (copy.fail)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (openwall.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (openwall.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (openwall.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (websec.net)

    Maturity: unknown

  • MetasploitMetasploitremoteVerified

    Copy Fail AF_ALG + authencesn Page-Cache Write

    exploit/linux/local/cve_2026_31431_copy_fail

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu155 products
  • linux< 6.17.0-29.29 | < 4.15.0-250.262 | < 5.4.0-230.250 | < 5.15.0-179.189 | < 6.8.0-117.117
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 6.17.0-1015.15 | < 4.15.0-1192.205 | < 5.4.0-1159.169 | < 5.15.0-1108.115 | < 6.8.0-1055.58
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Redhat23 products
Arista6 products
Chainguard5 products
  • linux-aws-6.12< 6.12.83-r2
  • linux-azure-6.12< 6.12.83-r2
  • linux-gcp-6.12< 6.12.83-r2
  • linux-qemu-6.12< 6.12.85-r0
  • linux-vmware-6.12< 6.12.85-r0
Opensuse3 products
  • leapEOL15.3 | 15.4 | 15.5 | 15.6
  • docker&distro=openSUSE Tumbleweed< 29.7.2_ce-41.1
  • systemtap&distro=openSUSE Tumbleweed< 5.5-1.1
Debian2 products
  • linux< 6.1.170-1 | < 6.12.85-1 | < 6.19.12-1
  • debian_linuxEOL11.0 | 12.0 | 13.0
Linux2 products
  • linux≥ 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, < 893d22e0135fa394db81df88697fba6032747667 | ≥ 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, < 19d43105a97be0810edbda875f2cd03f30dc130c | ≥ 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, < 961cfa271a918ad4ae452420e7c303149002875b | ≥ 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, < 3115af9644c342b356f3f07a4dd1c8905cd9a6fc | ≥ 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, < 8b88d99341f139e23bdeb1027a2a3ae10d341d82 | ≥ 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, < fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8 | ≥ 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, < ce42ee423e58dffa5ec03524054c9d8bfd4f6237 | ≥ 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, < a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5 | 4.14
  • linux_kernel≥ 4.14, < 5.10.254 | ≥ 5.11, < 5.15.204 | ≥ 5.16, < 6.1.170 | ≥ 6.2, < 6.6.137 | ≥ 6.7, < 6.12.85 | ≥ 6.13, < 6.18.22 | ≥ 6.19, < 6.19.12 | 7.0:rc1 | 7.0:rc2 | 7.0:rc3 | 7.0:rc4 | 7.0:rc5 | 7.0:rc6
Alpine1 product
  • docker< 29.4.3-r0
Amazon1 product
Canonical1 product
  • ubuntu_linuxEOLna | 14.04 | 16.04 | 18.04 | 20.04 | 22.04 | 24.04 | 25.10
Nixos1 product

11 vendors · 200 products · Showing 200 of 367

References

194 links
Show all 100 references

Showing 100 of 194.