What is the CVSS score of CVE-2026-31431?

CVE-2026-31431 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-31431?

Yes, a public proof-of-concept exploit is available for CVE-2026-31431. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-31431?

Within 24 hours: Inventory all systems running Linux kernel versions 4.14 through 6.19.x and assess exposure to untrusted local users. Within 7 days: Prioritize patching or upgrading kernels to version 6.20 or later on high-value systems; restrict local user access on systems that cannot be immediately patched. Within 30 days: Complete kernel upgrades across all affected infrastructure and validate that local user privileges are appropriately constrained.

Linux Kernel CVE-2026-31431

Q: Which versions of Linux Kernel are affected by CVE-2026-31431?

CVE-2026-31431 is a high-severity Linux kernel memory corruption vulnerability in the cryptographic interface that allows authenticated local users to escalate privileges to root.. A patch is available.

EUVD-2026-24639 HIGH

Incorrect Resource Transfer Between Spheres (CWE-669)

2026-04-22 Linux

GHSA-2274-3hgr-wxv6

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Obtain local user access
Delivery

Create AF_ALG socket for AEAD operations
Exploit

Craft malicious memory mappings
Install

Trigger in-place operation vulnerability
C2

Corrupt kernel memory structures
Execute

Execute arbitrary code as root
Impact

Escalate to full system control

Vulnerability Assessment

Weakness	CWE CWE-669 ASVS 5.0 V15 - Secure Coding and Architecture Incorrect resource transfer between spheres
Exploitation Conditions	Requires local authenticated access with ability to create AF_ALG sockets (typically any local user on default Linux configurations). The target kernel must be compiled with CONFIG_CRYPTO_USER_API_AEAD enabled (common in general-purpose distributions) and running a vulnerable version containing commit 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 without reversion patches. Exploitation requires the attacker to craft specific AEAD operation sequences that trigger the in-place operation code path with carefully constructed memory mappings. No elevated privileges or special capabilities are required beyond basic authenticated user access, but successful exploitation demands kernel memory layout knowledge and understanding of cryptographic API internals. User interaction is not required (UI:N). Attack complexity is low (AC:L) once the technical prerequisites are understood, though weaponization requires significant reverse engineering expertise.
Impact	CVSS 7.8 reflects local attack vector requiring authenticated access with low complexity (AV:L/AC:L/PR:L), but Technical Impact is total (C:H/I:H/A:H), enabling complete system compromise. EPSS 0.01% (1st percentile) indicates minimal automated scanning activity despite public POC availability, suggesting exploit requires specific technical knowledge to weaponize successfully. SSVC assessment confirms POC existence, non-automatable exploitation, and total technical impact - prioritization depends on whether systems allow untrusted local users. The vulnerability requires local authenticated access and specific cryptographic API usage patterns, limiting remote exploitation scenarios. However, local privilege escalation on multi-user systems or container escape scenarios represent critical risks. No CISA KEV listing indicates targeted rather than widespread exploitation. Real-world priority is HIGH for systems with untrusted local users (shared hosting, container platforms, HPC clusters) but MEDIUM for single-user workstations or systems with strong access controls. The gap between CVSS severity and low EPSS suggests sophisticated exploitation requirements despite available POCs.
Exploit ScenarioDerived	A local authenticated attacker with standard user privileges creates an AF_ALG socket to access the kernel's algif_aead interface and crafts malicious AEAD cryptographic operation requests with overlapping memory mappings. By exploiting the improper in-place operation handling, the attacker corrupts kernel memory structures to overwrite security-critical data such as credentials or function pointers. This achieves arbitrary kernel code execution with root privileges, allowing full system compromise including disabling security mechanisms, accessing all data, and establishing persistence.

Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.

Exploited in the wild (CISA KEV) Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv6 – Apr 30, 2026

Memory corruption in Linux kernel's algif_aead cryptographic interface allows local authenticated users to achieve arbitrary kernel memory read/write, leading to privilege escalation to root. The vulnerability stems from improper handling of in-place operations introduced in commit 72548b093ee3, affecting kernel versions from 4.14 through 6.19.x. Multiple public exploit codes exist including proof-of-concept demonstrations from security researchers, with EPSS score of 0.01% indicating currently low widespread exploitation likelihood despite POC availability.

Earlier versions of this analysis (1)

v1 Apr 27, 2026 - 14:24 CVSS 7.8

Local privilege escalation in Linux kernel crypto subsystem (algif_aead) affects versions 4.14 through 6.19.x via flawed in-place crypto operations introduced in commit 72548b093ee3. CVSS 7.8 indicates high impact across confidentiality, integrity, and availability with low attack complexity requiring only local low-privileged access. EPSS score of 0.01% (1st percentile) suggests minimal observed exploitation activity. Patches available in stable kernel versions 6.18.22, 6.19.12, and mainline 7.0 via upstream commits reverting the problematic in-place operation logic.

RemediationAI

Upgrade to patched kernel versions: 6.18.22, 6.19.12, or 7.0 and later from https://git.kernel.org/stable/. The fix reverts the problematic in-place operation logic in algif_aead while preserving associated data copying efficiency. For systems unable to immediately patch, restrict access to /proc/crypto and AF_ALG socket creation by disabling CONFIG_CRYPTO_USER_API_AEAD at compile time or using kernel module blacklisting for algif_aead (modprobe blacklist). This prevents userspace from invoking the vulnerable code path entirely but breaks applications depending on userspace AEAD operations (some VPN clients, custom crypto implementations). AppArmor or SELinux policies can restrict CAP_NET_ADMIN capability required for AF_ALG socket operations to trusted processes only, though this may impact legitimate cryptographic software. Monitor for unusual AF_ALG socket activity via auditd rules on socket(AF_ALG) syscalls. Compensating controls have significant functional impact - prioritize kernel patching over workarounds.

Affected VersionsENISA

Linux 4.14

Linux patch: 6.18.22

Linux patch: 6.19.12

Linux patch: 0

Linux patch: 7.0

Linux 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 <a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5

Linux 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 <fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8

Linux 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 <ce42ee423e58dffa5ec03524054c9d8bfd4f6237

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The algif_aead interface provides userspace access to kernel AEAD (Authenticated Encryption with Associated Data) cryptographic operations through AF_ALG sockets. The vulnerability exists in the kernel's crypto subsystem where commit 72548b093ee3 attempted to optimize performance by processing data in-place rather than copying between source and destination buffers. This optimization introduced CWE-669 (Incorrect Resource Transfer Between Spheres) violations, creating memory mapping confusion between userspace and kernel address spaces. The cryptographic API's handling of associated data and the interaction between different memory mappings allows crafted operations to corrupt kernel memory structures. Affected products identified via CPE include Linux kernel versions starting from 4.14, with patches targeting stable branches 6.18.22, 6.19.12, and mainline 7.0.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE HIGH

Red Hat 7.8 HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

May 04, 2026 - 18:16 cisa

CISA KEV

CIRCL Exploitation Confirmed

May 04, 2026 - 18:16 circl

CIRCL KEV

PoC Detected

May 04, 2026 - 18:16 vuln.today

Public exploit code

Patch released

May 04, 2026 - 18:16 nvd

Patch available

Added to CISA KEV

May 01, 2026 - 19:02 CISA

Patch released

May 01, 2026 - 06:00 NVD

article_added

Apr 30, 2026 - 10:05 vuln.today

trending_spike

Apr 30, 2026 - 10:05 vuln.today

Started Trending

Apr 30, 2026 - 10:04 vuln.today

14.4

exploit_published

Apr 29, 2026 - 00:00 copy.fail

CVSS changed

Apr 27, 2026 - 14:22 NVD

7.8 (HIGH)

CVE Published

Apr 22, 2026 - 08:15 nvd

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

crypto: algif_aead - Revert to operating out-of-place

This mostly reverts commit 72548b093ee3 except for the copying of the associated data.

There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

Articles & Coverage 10

POC Linux Page-Cache Write Vulnerabilities CVE-2026-31431 & CVE-2026-43284: Detector and LPE PoC Released May 17, 2026 medium.com Dirty Frag & CVE-2026-31431: Critical Linux Privilege Escalation Vulnerability May 10, 2026 infosecwriteups.com CVE-2026-31431 Copy-Fail: TryHackMe Exploitation Walkthrough May 09, 2026 elastic.co CVE-2026-31431: Copy Fail & DirtyFrag Linux Kernel Privilege Escalation May 09, 2026 medium.com CVE-2026-31431 Copy-Fail: Kernel LPE via Page Cache Corruption May 08, 2026 blog.cloudflare.com How Cloudflare responded to the “Copy Fail” Linux vulnerability May 07, 2026 medium.com CVE-2026-31431: Linux Privilege Escalation via Kernel Pipe/Splice Abuse May 06, 2026 unit42.paloaltonetworks.com CVE-2026-31431 Copy Fail: Critical Linux Kernel LPE Enabling Root Access May 05, 2026 infosecwriteups.com CVE-2026-31431: Linux Privilege Escalation via AF_ALG AEAD Socket Handling May 04, 2026 infosecwriteups.com CVE-2026-31431: Linux Kernel Privilege Escalation via AF_ALG Page Cache Corruption May 04, 2026

Executive ViewAI

Why It Matters

CVE-2026-31431 is a high-severity Linux kernel memory corruption vulnerability in the cryptographic interface that allows authenticated local users to escalate privileges to root. Organizations running affected kernel versions (4.14-6.19.x) face immediate risk of complete system compromise if an attacker gains local access, making this critical for infrastructure hosting sensitive workloads.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigation: Restrict cryptographic interface (algif_aead) access via SELinux or AppArmor policies; disable the af_alg socket family if cryptographic offloading is not required; enforce strict local user access controls and regularly audit user accounts with local shell access; monitor kernel logs for suspicious memory access patterns.

Threat Intelligence Overview

Threat Score

6.6/10

Composite threat intelligence

EPSS Score

0.0%

Top 99% exploitable

CIRCL KEV

Listed

Community Exploited Vulnerability

Threat Intel

1 sources

Exploit

POC

Public exploit code exists

Data Quality

12 sources

Confidence: High

EUVD

NVD

CVE.org

CISA KEV

EPSS

Vulnrichment CISA CERT-EU NEWS Fortinet MSRC POC (2) Vendor CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV Yes

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat Yes

Deciding rule

In CISA KEV with patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

Poc

System Exposure· derived

Small

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

134

Low Medium High Critical

KEV: +50

EPSS: 0

CVSS: +39

PoC: +20

Weaponized: +15

Threat intel: +10

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-669 – Incorrect Resource Transfer Between Spheres

View all

CVE-2020-1048 HIGH POC

7.8

CVE-2020-5800 CRITICAL POC

9.8

CVE-2020-15892 CRITICAL POC

9.8

CVE-2026-25253 HIGH POC

8.8

CVE-2020-25917 HIGH POC

8.8

CVE-2019-13266 HIGH POC

8.8

CVE-2019-13263 HIGH POC

8.8

CVE-2019-11875 HIGH POC

8.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: High

Product	Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.140 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.127	Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.156 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.128	Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.170 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.118	Affected
Container suse/sle-micro/base-5.5:2.0.4-5.8.270	Affected
Container suse/sle-micro/kvm-5.5:2.0.4-3.5.520	Affected

Threat IntelligenceMISP

CISA Advisories

ICSA-26-174-06 ICSA-26-195-02 ICSA-26-209-04 ICSA-26-260-06 ICSA-26-265-04

CERT-EU Advisories

CERT-EU-2026-005

Security News Coverage

webflow.sysdig.com medium.com wiz.io enesbuyuk.medium.com mainekhacker.medium.com infosecwriteups.com csa.gov.sg unit42.paloaltonetworks.com

Sources: Security News RSS, CERT-EU, CERT/CC, AWS, Metasploit/Nuclei, Fortinet PSIRT, CISA (public domain), Microsoft MSRC

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

Container suse/sle-micro/rt-5.5:2.0.4-4.5.580	Affected
Image SLES-Azure-3P Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-EC2 Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-GCE	Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-EC2 Image SLES-SAP-GCE-3P	Affected
Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure	Affected
Image SLES15-SP6-SAP-Azure-3P	Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard	Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-GCE-3P Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE	Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE	Affected
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP4	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 16.0	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise Live Patching 15 SP7	Fixed
SUSE Linux Enterprise Micro 5.2	Fixed
SUSE Linux Enterprise Micro 5.3	Fixed
SUSE Linux Enterprise Micro 5.4	Fixed
SUSE Linux Enterprise Micro 5.5	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7	Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7	Fixed
SUSE Linux Enterprise Module for Legacy 15 SP7	Fixed
SUSE Linux Enterprise Module for Public Cloud 15 SP7	Fixed
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7	Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP4-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP5-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server 16.0	Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP4	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP5	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed
SUSE Linux Enterprise Server for SAP applications 16.0	Fixed