CyberSecBulletin
CVE-2026-31719NVD status: Modified

Linux: Improper Validation of Integrity Check Value

Published Updated By the CyberSecBulletin desk

CVE-2026-31719 is a high-severity improper validation of integrity check value vulnerability in Linux, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 07cbb1bd424370671814a862913c99a6e1441588, e51f42114abbdf47f29dda43e7826be28907fcd2, 3bfbf5f0a99c991769ec562721285df7ab69240b as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.18% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 07cbb1bd424370671814a862913c99a6e1441588 or e51f42114abbdf47f29dda43e7826be28907fcd2 or 3bfbf5f0a99c991769ec562721285df7ab69240b, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.18.25 or 7.0.2, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxd1775a177f7f38156d541c8a3e3c91eaa6e69699 up to, but not including, 07cbb1bd424370671814a862913c99a6e1441588; d1775a177f7f38156d541c8a3e3c91eaa6e69699 up to, but not including, e51f42114abbdf47f29dda43e7826be28907fcd2; d1775a177f7f38156d541c8a3e3c91eaa6e69699 up to, but not including, 3bfbf5f0a99c991769ec562721285df7ab69240b; 6.1507cbb1bd424370671814a862913c99a6e1441588, e51f42114abbdf47f29dda43e7826be28907fcd2, 3bfbf5f0a99c991769ec562721285df7ab69240b
LinuxLinux Kernel6.15 up to, but not including, 6.18.25; 6.19 up to, but not including, 7.0.2; 7.16.18.25, 7.0.2

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
HighData or code can be modified at will.
Availability
NoneAvailability is not affected.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5enc - fix async decrypt skipping hash verification krb5enc_dispatch_decrypt() sets req->base.complete as the skcipher callback, which is the caller's own completion handler. When the skcipher completes asynchronously, this signals "done" to the caller without executing krb5enc_dispatch_decrypt_hash(), completely bypassing the integrity verification (hash check). Compare with the encrypt path which correctly uses krb5enc_encrypt_done as an intermediate callback to chain into the hash computation on async completion. Fix by adding krb5enc_decrypt_done as an intermediate callback that chains into krb5enc_dispatch_decrypt_hash() upon async skcipher completion, matching the encrypt path's callback pattern. Also fix EBUSY/EINPROGRESS handling throughout: remove krb5enc_request_complete() which incorrectly swallowed EINPROGRESS notifications that must be passed up to callers waiting on backlogged requests, and add missing EBUSY checks in krb5enc_encrypt_ahash_done for the dispatch_encrypt return value. Unset MAY_BACKLOG on the async completion path so the user won't see back-to-back EINPROGRESS notifications.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Validation of Integrity Check Value

The product does not validate or incorrectly validates the integrity check values or checksums of a message.

How developers prevent this class of flaw

  • The protocol specification describes the algorithm used for calculating the checksum. It is then a matter of implementing the calculation and verifying that the calculated checksum and the received checksum match.

More Improper Validation of Integrity Check Value vulnerabilities (CWE-354)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Validation of Integrity Check Value vulnerabilities

Spotted an error? Tell us.