Skip to content
Log inStart free trial

CVE-2026-31431

crypto: algif_aead - Revert to operating out-of-place

High Known exploited Linux
Severity
7.8 / 10
High · CVSS 3.1
Exploit chance (EPSS)
98.11%
Chance of exploitation in the next 30 days. Higher than 99.91% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since May 1, 2026
Weakness
CWE-1288 Improper Validation of Consistency within Input
CWE-669 Incorrect Resource Transfer Between Spheres
Fix
6.19.12
Upgrade Kernel to this version or later
Exploited in the wild. Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability (Linux Kernel). Required action: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by May 15, 2026.

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: algif_aead - Revert to operating out-of-place

This mostly reverts commit 72548b093ee3 except for the copying of the associated data.

There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

Affected versions

Linux

PackageVulnerableFixed in
Kernel
>= 4.14.0, < 5.10.254
>= 5.11.0, < 5.15.204
>= 5.16.0, < 6.1.170
>= 6.2.0, < 6.6.137
>= 6.7.0, < 6.12.85
>= 6.13.0, < 6.18.22
>= 6.19.0, < 6.19.12
5.10.254
5.15.204
6.1.170
6.6.137
6.12.85
6.18.22
6.19.12

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

Kernel Linux → 6.19.12

Set Kernel to 6.19.12 or later in your manifest.

Severity breakdown

CVSS 3.1 7.8

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector
Local
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-1288: Improper Validation of Consistency within Input

The product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.

How to prevent it
  • Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

CWE-669: Incorrect Resource Transfer Between Spheres

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

References

Advisories

Exploits and evidence

Issue reports

Write-ups

Packages

Other links

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
CVE-2026-53362
ipv6: account for fraggap on the paged allocation path
High Known exploited Also affects Kernel
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
High Known exploited Also affects Kernel
CVE-2026-46300
net: skbuff: preserve shared-frag marker during coalescing
High Known exploited Also affects Kernel
CVE-2025-39964
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
Medium Known exploited Also affects Kernel
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
Critical Known exploited Also affects Kernel
CVE-2025-38352
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
High Known exploited Also affects Kernel
CVE-2024-53197
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
High Known exploited Also affects Kernel
CVE-2024-53150
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
High Known exploited Also affects Kernel
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor