CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
Vulnerability summary
CVE-2026-31431 is a high (CVSS 7.8) vulnerability in Linux Kernel. It is known to be exploited: CISA and CIRCL list it, first on 01-05-2026. EPSS estimates a 98.11% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 9 public exploits are recorded.
Listed as exploited by CIRCL (02-05-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 56 · Related 52Timeline
- 22-04-2026PublishedVulnerability first disclosed.
- 01-05-2026Added to CISA KEVExploitedLinux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
- 02-05-2026Added to CIRCL KEVExploitedAdded to the CIRCL known exploited vulnerabilities catalog.
- 15-05-2026CISA remediation dueDeadline passedApply mitigations per vendor instructions.
- 15-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · Red hatEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
98.11%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
Increase +94.68 pp
From 3.44% on 04-10-2026
Known exploited
Compare KEV catalogs- Added
- 01-05-2026
- Federal due date
- 15-05-2026
Not in the ENISA CNW catalog.
- Added
- 02-05-2026
CISA required action
"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/ xint.io/blog/copy-fail-linux-distributions git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/about/ nvd.nist.gov/vuln/detail/CVE-2026-31431
Public exploits
9 foundCopy Fail Cve 2026 31431
Maturity: poc
Exploit Reference (xint.io)
Maturity: unknown
Exploit Reference (openwall.com)
Maturity: unknown
Show all 9 exploits
Exploit Reference (copy.fail)
Maturity: unknown
Exploit Reference (openwall.com)
Maturity: unknown
Exploit Reference (openwall.com)
Maturity: unknown
Exploit Reference (openwall.com)
Maturity: unknown
Exploit Reference (websec.net)
Maturity: unknown
Copy Fail AF_ALG + authencesn Page-Cache Write
exploit/linux/local/cve_2026_31431_copy_fail
Maturity: weaponized
Weaknesses
CWE · root cause- CWE-669Incorrect Resource Transfer Between SpheresThe product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
- CWE-1288Improper Validation of Consistency within InputThe product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu155 products
- linux< 6.17.0-29.29 | < 4.15.0-250.262 | < 5.4.0-230.250 | < 5.15.0-179.189 | < 6.8.0-117.117
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 6.17.0-1015.15 | < 4.15.0-1192.205 | < 5.4.0-1159.169 | < 5.15.0-1108.115 | < 6.8.0-1055.58
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Redhat23 products
- enterprise_linux8.0 | 9.0 | 10.0
- enterprise_linux_aus8.4 | 8.6
- enterprise_linux_eus8.4 | 9.4 | 9.6 | 10.0
- enterprise_linux_tus8.6 | 8.8
- enterprise_linux_update_services_for_sap_solutions8.6 | 8.8 | 9.0 | 9.2
Arista6 products
- cloudvision_agni≥ 2024.4.0, ≤ 2025.2.2
- cloudvision_portal≥ 2024.2.0, ≤ 2026.1.0
- netvisor_os< 7.1.0 | 7.1.0 | 7.1.0:hotfix7
- velocloud_edge≥ 4.5.0, ≤ 6.4.1
- velocloud_gatewayna
Chainguard5 products
- linux-aws-6.12< 6.12.83-r2
- linux-azure-6.12< 6.12.83-r2
- linux-gcp-6.12< 6.12.83-r2
- linux-qemu-6.12< 6.12.85-r0
- linux-vmware-6.12< 6.12.85-r0
Opensuse3 products
- leapEOL15.3 | 15.4 | 15.5 | 15.6
- docker&distro=openSUSE Tumbleweed< 29.7.2_ce-41.1
- systemtap&distro=openSUSE Tumbleweed< 5.5-1.1
Debian2 products
- linux< 6.1.170-1 | < 6.12.85-1 | < 6.19.12-1
- debian_linuxEOL11.0 | 12.0 | 13.0
Linux2 products
- linux≥ 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, < 893d22e0135fa394db81df88697fba6032747667 | ≥ 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, < 19d43105a97be0810edbda875f2cd03f30dc130c | ≥ 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, < 961cfa271a918ad4ae452420e7c303149002875b | ≥ 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, < 3115af9644c342b356f3f07a4dd1c8905cd9a6fc | ≥ 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, < 8b88d99341f139e23bdeb1027a2a3ae10d341d82 | ≥ 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, < fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8 | ≥ 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, < ce42ee423e58dffa5ec03524054c9d8bfd4f6237 | ≥ 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, < a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5 | 4.14
- linux_kernel≥ 4.14, < 5.10.254 | ≥ 5.11, < 5.15.204 | ≥ 5.16, < 6.1.170 | ≥ 6.2, < 6.6.137 | ≥ 6.7, < 6.12.85 | ≥ 6.13, < 6.18.22 | ≥ 6.19, < 6.19.12 | 7.0:rc1 | 7.0:rc2 | 7.0:rc3 | 7.0:rc4 | 7.0:rc5 | 7.0:rc6
Alpine1 product
- docker< 29.4.3-r0
Amazon1 product
Canonical1 product
- ubuntu_linuxEOLna | 14.04 | 16.04 | 18.04 | 20.04 | 22.04 | 24.04 | 25.10
Nixos1 product
- nixos< 25.11
11 vendors · 200 products · Showing 200 of 367
References
194 linksShow all 100 references
- lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/MitigationWEBVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-31431Government ResourceWEBUS Government Resource
- websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170ARTICLEExploitThird Party Advisory
- cert-portal.siemens.com/productcert/html/ssa-328642.htmlThird Party Advisory
- access.redhat.com/security/cve/CVE-2026-31431VDB EntryX Refsource REDHATREPORTAdvisoryThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2460538Issue TrackingX Refsource REDHATREPORTThird Party Advisory
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31431.jsonX Sadp Csaf VexWEBThird Party Advisory
- access.redhat.com/errata/RHSA-2026:14926Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- access.redhat.com/errata/RHSA-2026:33486Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- access.redhat.com/errata/RHSA-2026:14097Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- access.redhat.com/errata/RHSA-2026:14112Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- access.redhat.com/errata/RHSA-2026:15087Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- access.redhat.com/errata/RHSA-2026:14773Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- access.redhat.com/errata/RHSA-2026:13729Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- access.redhat.com/errata/RHSA-2026:13885Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- access.redhat.com/errata/RHSA-2026:13727Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
Showing 100 of 194.