erroneo.us
Search all guides⌘K

Security Digest · Vulnerability record · Known exploited

CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

Exploited in the wild (CISA KEV). In the Linux kernel, the following vulnerability has been resolved: crypto: algifaead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data.

CISA KEV · added 2026-05-01 CVSS 7.8 High EPSS 3.4% · p89 Act now

Updated By erroneo.us Security Desk123 references Seen in the digest for May 1, 2026

Should you act?

Exploited: patch now if you run it

CISA has confirmed exploitation in the wild. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

  • Yes, if you run Linux Kernel. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2026-05-01, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2026-05-15; treat that as the outer limit, not the target.
  • EPSS 3.4%, percentile 89: FIRST’s model estimates a 3.4% chance of exploitation activity in the next 30 days, higher than 89% of all scored CVEs (elevated). EPSS is a probability, not a verdict.
  • Needs local access needed. Lower urgency for most teams unless an attacker could already run code on the machine.
  • Editorial verdict: Act now. Copy Fail: Exploited Linux Kernel Root Exploit Since 2017 — Any Linux box that runs code from more than one trust level (CI runners, container hosts, shared servers) needs a patched kernel and reboot now; single-user machines can patch on a short cycle.

What it is

In the Linux kernel, the following vulnerability has been resolved: crypto: algifaead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algifaead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

CISA’s summary

Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.

Weakness type: CWE-669, CWE-1288.

Product: Linux Kernel · Assigned by: Linux · Published: 2026-04-22

Affected and fixed versions

VendorProductAffected versions (per CVE record)
LinuxLinux72548b093ee38a6d4f2a19e6ef1948ae05c181f7 < 893d22e0135fa394db81df88697fba6032747667, 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 < 19d43105a97be0810edbda875f2cd03f30dc130c, 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 < 961cfa271a918ad4ae452420e7c303149002875b, 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 <…
LinuxLinux4.14

Severity scores

Scored byCVSSScoreVector
Linux3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
redhat-SADP3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • Attack vector: local access needed
  • Attack complexity: low
  • Privileges required: low (any account)
  • User interaction: none
  • Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

  • CISA KEV: added 2026-05-01; federal due date 2026-05-15. Known ransomware use: Unknown.
  • CISA required action: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
  • CISA SSVC assessment: exploitation active, automatable no, technical impact total.
  • FIRST EPSS (model of 2026-10-21): 3.44% probability of exploitation activity in the next 30 days; percentile 89.

Timeline

  • — CVE record published by Linux
  • — erroneo.us brief: Copy Fail: Exploited Linux Kernel Root Exploit Since 2017
  • — Added to CISA’s Known Exploited Vulnerabilities catalog
  • — CISA remediation deadline for US federal agencies
  • — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vendor and project advisories, patches

  1. xint.io xint.io
  2. lore.kernel.org lore.kernel.org
  3. access.redhat.com access.redhat.com
  4. access.redhat.com access.redhat.com
  5. access.redhat.com access.redhat.com
  6. access.redhat.com access.redhat.com
  7. access.redhat.com access.redhat.com
  8. access.redhat.com access.redhat.com
  9. access.redhat.com access.redhat.com
  10. access.redhat.com access.redhat.com
  11. access.redhat.com access.redhat.com
  12. access.redhat.com access.redhat.com
  13. access.redhat.com access.redhat.com
  14. access.redhat.com access.redhat.com
  15. access.redhat.com access.redhat.com
  16. access.redhat.com access.redhat.com
  17. access.redhat.com access.redhat.com
  18. access.redhat.com access.redhat.com
  19. access.redhat.com access.redhat.com
  20. access.redhat.com access.redhat.com
  21. access.redhat.com access.redhat.com
  22. access.redhat.com access.redhat.com
  23. access.redhat.com access.redhat.com
  24. access.redhat.com access.redhat.com
  25. access.redhat.com access.redhat.com
  26. access.redhat.com access.redhat.com
  27. access.redhat.com access.redhat.com
  28. access.redhat.com access.redhat.com
  29. access.redhat.com access.redhat.com
  30. access.redhat.com access.redhat.com
  31. access.redhat.com access.redhat.com
  32. access.redhat.com access.redhat.com
  33. Listed in CISA KEV notes (git.kernel.org) git.kernel.org

Vulnerability records

  1. CVE.org record CVE-2026-31431 cve.org
  2. NVD entry CVE-2026-31431 nvd.nist.gov

Government

  1. CISA Known Exploited Vulnerabilities catalog entry cisa.gov

Other references from the CVE record and advisory

  1. git.kernel.org git.kernel.org
  2. git.kernel.org git.kernel.org
  3. git.kernel.org git.kernel.org
  4. git.kernel.org git.kernel.org
  5. git.kernel.org git.kernel.org
  6. git.kernel.org git.kernel.org
  7. git.kernel.org git.kernel.org
  8. git.kernel.org git.kernel.org
  9. github.com github.com
  10. openwall.com openwall.com
  11. copy.fail copy.fail
  12. openwall.com openwall.com
  13. openwall.com openwall.com
  14. openwall.com openwall.com
  15. openwall.com openwall.com
  16. openwall.com openwall.com
  17. openwall.com openwall.com
  18. openwall.com openwall.com
  19. openwall.com openwall.com
  20. openwall.com openwall.com
  21. openwall.com openwall.com
  22. openwall.com openwall.com
  23. openwall.com openwall.com
  24. openwall.com openwall.com
  25. websec.net websec.net
  26. openwall.com openwall.com
  27. openwall.com openwall.com
  28. openwall.com openwall.com
  29. openwall.com openwall.com
  30. openwall.com openwall.com
  31. openwall.com openwall.com
  32. openwall.com openwall.com
  33. openwall.com openwall.com
  34. openwall.com openwall.com
  35. openwall.com openwall.com
  36. openwall.com openwall.com
  37. openwall.com openwall.com
  38. openwall.com openwall.com
  39. openwall.com openwall.com
  40. openwall.com openwall.com
  41. openwall.com openwall.com
  42. openwall.com openwall.com
  43. openwall.com openwall.com
  44. openwall.com openwall.com
  45. openwall.com openwall.com
  46. openwall.com openwall.com
  47. openwall.com openwall.com
  48. openwall.com openwall.com
  49. openwall.com openwall.com
  50. openwall.com openwall.com
  51. openwall.com openwall.com
  52. openwall.com openwall.com
  53. openwall.com openwall.com
  54. openwall.com openwall.com
  55. openwall.com openwall.com
  56. openwall.com openwall.com
  57. openwall.com openwall.com
  58. openwall.com openwall.com
  59. openwall.com openwall.com
  60. openwall.com openwall.com
  61. openwall.com openwall.com
  62. openwall.com openwall.com
  63. openwall.com openwall.com
  64. openwall.com openwall.com
  65. openwall.com openwall.com
  66. openwall.com openwall.com
  67. openwall.com openwall.com
  68. openwall.com openwall.com
  69. openwall.com openwall.com
  70. openwall.com openwall.com
  71. openwall.com openwall.com
  72. openwall.com openwall.com
  73. openwall.com openwall.com
  74. openwall.com openwall.com
  75. openwall.com openwall.com
  76. openwall.com openwall.com
  77. openwall.com openwall.com
  78. openwall.com openwall.com
  79. kb.cert.org kb.cert.org
  80. openwall.com openwall.com
  81. cert-portal.siemens.com cert-portal.siemens.com
  82. cert-portal.siemens.com cert-portal.siemens.com
  83. cert-portal.siemens.com cert-portal.siemens.com
  84. cert-portal.siemens.com cert-portal.siemens.com
  85. access.redhat.com access.redhat.com
  86. RHBZ#2460538 bugzilla.redhat.com
  87. security.access.redhat.com security.access.redhat.com

All exploited Linux vulnerabilities · Today’s Security Digest