CVE-2026-31431
Published: 22 April 2026
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since…
more
the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the vulnerability by requiring timely application of Linux kernel patches that revert the unnecessary in-place operation in algif_aead.
Enables identification of systems affected by CVE-2026-31431 through regular vulnerability scanning of kernel versions.
Mitigates potential memory corruption from improper in-place operations on different mappings via mechanisms like ASLR and non-executable memory.
Security SummaryAI
CVE-2026-31431 is a vulnerability in the Linux kernel's crypto/algif_aead component, stemming from an unnecessary in-place operation introduced in commit 72548b093ee3. The fix reverts to out-of-place operation, retaining only the copying of associated data, as source and destination buffers originate from different mappings, providing no performance benefit while adding complexity. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-669.
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation enables high-impact disruption to confidentiality, integrity, and availability.
Mitigation involves applying the stable kernel patches referenced in the following commits: 19d43105a97be0810edbda875f2cd03f30dc130c, 3115af9644c342b356f3f07a4dd1c8905cd9a6fc, 893d22e0135fa394db81df88697fba6032747667, 8b88d99341f139e23bdeb1027a2a3ae10d341d82, and 961cfa271a918ad4ae452420e7c303149002875b, available via git.kernel.org.
Details
- CWE(s)
- KEV Date Added
- 01 May 2026
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel vulnerability in crypto subsystem with low-priv attacker and full C/I/A impact directly enables T1068 (Exploitation for Privilege Escalation).