CVE-2026-31431Exploited in the wildNVD status: Analyzed
Linux Kernel Incorrect Resource Transfer Between Spheres
CVE-2026-31431 is a high-severity incorrect resource transfer between spheres vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 893d22e0135fa394db81df88697fba6032747667, 19d43105a97be0810edbda875f2cd03f30dc130c, 961cfa271a918ad4ae452420e7c303149002875b as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. CISA added it to the Known Exploited Vulnerabilities catalogue on May 1, 2026, which means attacks have been observed in the wild.
Patch now
Attackers are already exploiting this vulnerability, according to CISA.
What to do
- Update Linux to 893d22e0135fa394db81df88697fba6032747667 or 19d43105a97be0810edbda875f2cd03f30dc130c or 961cfa271a918ad4ae452420e7c303149002875b or 3115af9644c342b356f3f07a4dd1c8905cd9a6fc, whichever matches your release line, or a later version.
- Update SIMATIC CN 4100 to V6.0 or a later version.
- Update SIMATIC HMI MTP1000 Unified Basic to V21 Update 2 SR1 or a later version.
- CISA's required action: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 up to, but not including, 893d22e0135fa394db81df88697fba6032747667; 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 up to, but not including, 19d43105a97be0810edbda875f2cd03f30dc130c; 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 up to, but not including, 961cfa271a918ad4ae452420e7c303149002875b; 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 up to, but not including, 3115af9644c342b356f3f07a4dd1c8905cd9a6fc; 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 up to, but not including, 8b88d99341f139e23bdeb1027a2a3ae10d341d82; 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 up to, but not including, fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8; 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 up to, but not including, ce42ee423e58dffa5ec03524054c9d8bfd4f6237; 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 up to, but not including, a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5; and 1 more ranges | 893d22e0135fa394db81df88697fba6032747667, 19d43105a97be0810edbda875f2cd03f30dc130c, 961cfa271a918ad4ae452420e7c303149002875b, 3115af9644c342b356f3f07a4dd1c8905cd9a6fc, 8b88d99341f139e23bdeb1027a2a3ae10d341d82, fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8 |
| Red Hat | NVIDIA for RHEL 10 | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 10 | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 8 | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 9 | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | Not specified in the record | Not stated |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | Not specified in the record | Not stated |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | Not specified in the record | Not stated |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | Not specified in the record | Not stated |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | Not specified in the record | Not stated |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | Not specified in the record | Not stated |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | Not specified in the record | Not stated |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | Not specified in the record | Not stated |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | Not specified in the record | Not stated |
Version data comes from the organisation that assigned the CVE; 35 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | CNA |
| CVSS 3.1 | 7.8 | High | CNA |
Official description
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Incorrect Resource Transfer Between Spheres
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
More Incorrect Resource Transfer Between Spheres vulnerabilities (CWE-669)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: total).
- Added to CISA's Known Exploited Vulnerabilities catalogue.
- Deadline for US federal agencies to remediate, set by CISA.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130c
- git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fc
- git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667
- git.kernel.org/stable/c/8b88d99341f139e23bdeb1027a2a3ae10d341d82
- git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875b
- git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5
- git.kernel.org/stable/c/ce42ee423e58dffa5ec03524054c9d8bfd4f6237
- git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8
- openwall.com/lists/oss-security/2026/04/29/23Exploit, Mailing List
- openwall.com/lists/oss-security/2026/04/29/25Mailing List
- openwall.com/lists/oss-security/2026/04/29/26Exploit, Mailing List
- openwall.com/lists/oss-security/2026/04/30/10Mailing List
- openwall.com/lists/oss-security/2026/04/30/11Mailing List
- openwall.com/lists/oss-security/2026/04/30/12Mailing List
- openwall.com/lists/oss-security/2026/04/30/14Mailing List
Technical write-ups (may include proof of concept)
- openwall.com/lists/oss-security/2026/04/30/18Exploit, Mailing List
Other references
- openwall.com/lists/oss-security/2026/04/30/17Mailing List
- openwall.com/lists/oss-security/2026/04/30/2Mailing List
- openwall.com/lists/oss-security/2026/04/30/20Mailing List
- openwall.com/lists/oss-security/2026/04/30/6Mailing List
- openwall.com/lists/oss-security/2026/05/01/10Mailing List
- openwall.com/lists/oss-security/2026/05/01/12Mailing List
- openwall.com/lists/oss-security/2026/05/01/15Mailing List
- openwall.com/lists/oss-security/2026/05/01/16Mailing List
- openwall.com/lists/oss-security/2026/05/01/17Mailing List
- openwall.com/lists/oss-security/2026/05/01/18Mailing List
- openwall.com/lists/oss-security/2026/05/01/2Mailing List
- openwall.com/lists/oss-security/2026/05/01/22Mailing List
- openwall.com/lists/oss-security/2026/05/01/23Mailing List
- openwall.com/lists/oss-security/2026/05/01/24Mailing List
- openwall.com/lists/oss-security/2026/05/01/3Mailing List
Recent Incorrect Resource Transfer Between Spheres vulnerabilities
- 8.2 High severity
- 8.8 High severity
- 8.2 High severity
- 8.8 High severity
- 9.8 Critical severity
- 7.7 High severity
Spotted an error? Tell us.