CVE-2026-31431: Linux kernel algif_aead in-place crypto operation flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: medium.

critical priorityIt is in CISA KEV with a near-maximum EPSS score, public exploit references, and a CVSS of 7.8 with High impact across all three categories.

What it is

The Linux kernel's algif_aead AF_ALG AEAD interface operated in-place on buffers that come from different mappings, a flaw the fix resolves by reverting to out-of-place operation and copying associated data directly. The record does not describe the concrete memory-safety consequence, but the CVSS vector rates confidentiality, integrity and availability all High, and the issue is listed in CISA KEV with a near-certain EPSS score.

Impact

An attacker with local access can potentially achieve high impact across confidentiality, integrity and availability, consistent with memory corruption in kernel crypto handling. The record does not state whether privilege escalation to root is the confirmed outcome.

Attack surface

The CVSS vector is AV:L/PR:L/UI:N, so the flaw is reached locally by an authenticated user with low privileges and requires no user interaction. It is exercised through the kernel's AF_ALG crypto socket interface (algif_aead), not over the network.

Exploitation

CISA added it to KEV on 2026-05-01 with a remediation due date of 2026-05-15, and EPSS gives a 30-day probability of 0.99907 (99.966th percentile). Several oss-security references are tagged Exploit, indicating public exploit material exists, though no ransomware campaign use is documented.

What to do

• Apply the upstream kernel patches referenced in the git.kernel.org stable commits and update to the fixed kernel version from your distribution (Red Hat, Amazon, Canonical, Debian, SUSE, openSUSE, NixOS, Arista, Siemens).
• Follow vendor and CISA BOD 22-01 guidance, meeting the KEV due date of 2026-05-15 for internet-facing and cloud services.
• Where patching is not immediately possible, restrict local shell and container access to trusted users, since exploitation requires a local low-privileged account.
• Consider blocking or restricting AF_ALG crypto socket use via seccomp or module policy on hosts that do not need kernel crypto sockets.
• Track vendor advisories for the listed products (OpenShift, Enterprise Linux variants, Ubuntu, Debian, Leap, OpenStack, Siemens and Arista platforms) to confirm fixed builds.

Detection

• Monitor for unexpected AF_ALG socket creation and use of the algif_aead interface by non-standard processes.
• Alert on local privilege escalation attempts and unusual kernel crash or oops events on hosts running unpatched kernels.
• Correlate process execution of crypto-related tooling with subsequent privilege changes or suspicious child processes.
• Verify kernel versions against vendor fixed builds and report hosts still running vulnerable kernels.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.