CVEs / CVE-2026-31431
CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
- Known exploited in the CISA KEV catalog since 1 May 2026
- high 7.8 CVSS 3.1 (from the CNA)
- EPSS 98.1% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2026-31431
Summary
Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Linux Linux | from 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, before 893d22e0135fa394db81df88697fba6032747667 | 893d22e0135fa394db81df88697fba6032747667 |
| Linux Linux | from 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, before 19d43105a97be0810edbda875f2cd03f30dc130c | 19d43105a97be0810edbda875f2cd03f30dc130c |
| Linux Linux | from 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, before 961cfa271a918ad4ae452420e7c303149002875b | 961cfa271a918ad4ae452420e7c303149002875b |
| Linux Linux | from 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, before 3115af9644c342b356f3f07a4dd1c8905cd9a6fc | 3115af9644c342b356f3f07a4dd1c8905cd9a6fc |
| Linux Linux | from 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, before 8b88d99341f139e23bdeb1027a2a3ae10d341d82 | 8b88d99341f139e23bdeb1027a2a3ae10d341d82 |
| Linux Linux | from 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, before fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8 | fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8 |
| Linux Linux | from 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, before ce42ee423e58dffa5ec03524054c9d8bfd4f6237 | ce42ee423e58dffa5ec03524054c9d8bfd4f6237 |
| Linux Linux | from 72548b093ee38a6d4f2a19e6ef1948ae05c181f7, before a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5 | a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5 |
| Linux Linux | 4.14 | — |
| Siemens SIMATIC AX Runtime Core Linux Common Debian | all versions | — |
| Siemens SIMATIC AX Runtime Core Linux Common Debian arm64 | all versions | — |
| Siemens SIMATIC AX Runtime Core Linux Platform Container Common Debian Development | all versions | — |
| Siemens SIMATIC AX Runtime Core Linux VMWare Development | all versions | — |
| Siemens SIMATIC CN 4100 | before V6.0 | V6.0 |
| Siemens SIMATIC HMI MTP1000 Unified Basic | before V21 Update 2 SR1 | V21 Update 2 SR1 |
| Siemens SIMATIC HMI MTP1000 Unified Comfort Panel | before V21 Update 2 SR1 | V21 Update 2 SR1 |
| Siemens SIMATIC HMI MTP1000 Unified Comfort Panel hygienic | before V21 Update 2 SR1 | V21 Update 2 SR1 |
| Siemens SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design | before V21 Update 2 SR1 | V21 Update 2 SR1 |
| Siemens SIMATIC HMI MTP1000, Unified Comfort Panel neutral | before V21 Update 2 SR1 | V21 Update 2 SR1 |
| Siemens SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) | before V21 Update 2 SR1 | V21 Update 2 SR1 |
| Siemens SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit | before V21 Update 2 SR1 | V21 Update 2 SR1 |
| Siemens SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) | before V21 Update 2 SR1 | V21 Update 2 SR1 |
| Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) | before V21 Update 2 SR1 | V21 Update 2 SR1 |
| Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extension | before V21 Update 2 SR1 | V21 Update 2 SR1 |
| Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) | before V21 Update 2 SR1 | V21 Update 2 SR1 |
| Siemens SIMATIC HMI MTP1200 Unified Basic | before V21 Update 2 SR1 | V21 Update 2 SR1 |
| Siemens SIMATIC HMI MTP1200 Unified Comfort Panel | before V21 Update 2 SR1 | V21 Update 2 SR1 |
| Siemens SIMATIC HMI MTP1200 Unified Comfort Panel hygienic | before V21 Update 2 SR1 | V21 Update 2 SR1 |
| Siemens SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design | before V21 Update 2 SR1 | V21 Update 2 SR1 |
| Siemens SIMATIC HMI MTP1200 Unified Comfort Panel neutral design | before V21 Update 2 SR1 | V21 Update 2 SR1 |
| Product | Affected | Fixed in |
|---|---|---|
| Kernel (Linux) | from 4.14.0, before 5.10.254 | 5.10.254 |
| Kernel (Linux) | from 5.11.0, before 5.15.204 | 5.15.204 |
| Kernel (Linux) | from 5.16.0, before 6.1.170 | 6.1.170 |
| Kernel (Linux) | from 6.2.0, before 6.6.137 | 6.6.137 |
| Kernel (Linux) | from 6.7.0, before 6.12.85 | 6.12.85 |
| Kernel (Linux) | from 6.13.0, before 6.18.22 | 6.18.22 |
| Kernel (Linux) | from 6.19.0, before 6.19.12 | 6.19.12 |
Exploitation
| In CISA KEV since | 1 May 2026 |
|---|---|
| Due date for US federal agencies | 15 May 2026 |
| Used in ransomware campaigns | Unknown |
| Required action | "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
Severity
| CVSS 3.1 | 7.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HScored by the CNA (416baaa9-dc9f-4396-8d5f-8c081fb06d67) |
|---|---|
| Weakness | CWE-669, CWE-1288 |
References
- CVE-2026-31431 on NVD
- CVE-2026-31431 in the CISA KEV catalog
- https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/ (cited by CISA)
- https://xint.io/blog/copy-fail-linux-distributions#the-fix-6 (cited by CISA)
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/about/ (cited by CISA)
- CVE-2026-31431 on OSV
- https://git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130c Patch
- https://git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fc Patch
- https://git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667 Patch
- https://git.kernel.org/stable/c/8b88d99341f139e23bdeb1027a2a3ae10d341d82 Patch
- https://git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875b Patch
- https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5 Patch
- https://git.kernel.org/stable/c/ce42ee423e58dffa5ec03524054c9d8bfd4f6237 Patch
- https://git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8 Patch
- http://www.openwall.com/lists/oss-security/2026/04/29/23 Exploit, Mailing List, Patch
- http://www.openwall.com/lists/oss-security/2026/04/29/25 Mailing List, Patch
- http://www.openwall.com/lists/oss-security/2026/04/29/26 Exploit, Mailing List, Patch
- http://www.openwall.com/lists/oss-security/2026/04/30/10 Mailing List, Patch
- http://www.openwall.com/lists/oss-security/2026/04/30/11 Mailing List, Patch
- http://www.openwall.com/lists/oss-security/2026/04/30/12 Mailing List, Patch
- http://www.openwall.com/lists/oss-security/2026/04/30/14 Mailing List, Patch
- http://www.openwall.com/lists/oss-security/2026/04/30/15 Mailing List, Patch
- http://www.openwall.com/lists/oss-security/2026/04/30/16 Mailing List, Patch
- http://www.openwall.com/lists/oss-security/2026/04/30/17 Mailing List
- http://www.openwall.com/lists/oss-security/2026/04/30/18 Exploit, Mailing List
- http://www.openwall.com/lists/oss-security/2026/04/30/2 Mailing List
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.