Skip to main content

Linux Kernel CVE-2026-31677

| EUVDEUVD-2026-25644 MEDIUM
2026-04-25 Linux
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only vector via AF_ALG socket; low privilege sufficient; pure availability impact with zero confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Generated
Jul 24, 2026 - 02:15 vuln.today
CVSS changed
May 06, 2026 - 21:37 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 18:32 nvd
Patch available
Patch available
Apr 25, 2026 - 10:16 EUVD
EUVD ID Assigned
Apr 25, 2026 - 09:00 euvd
EUVD-2026-25644
CVE Published
Apr 25, 2026 - 08:46 nvd
N/A
CVE Published
Apr 25, 2026 - 08:46 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

crypto: af_alg - limit RX SG extraction by receive buffer budget

Make af_alg_get_rsgl() limit each RX scatterlist extraction to the remaining receive buffer budget.

af_alg_get_rsgl() currently uses af_alg_readable() only as a gate before extracting data into the RX scatterlist. Limit each extraction to the remaining af_alg_rcvbuf(sk) budget so that receive-side accounting matches the amount of data attached to the request.

If skcipher cannot obtain enough RX space for at least one chunk while more data remains to be processed, reject the recvmsg call instead of rounding the request length down to zero.

AnalysisAI

Denial of service in the Linux kernel's AF_ALG crypto socket subsystem allows a local, low-privileged user to crash or hang the system via crafted recvmsg calls. The flaw in af_alg_get_rsgl() causes receive buffer accounting to diverge from actual data attached to skcipher requests - when insufficient RX space remains, the kernel rounds the request length to zero rather than rejecting it, producing an invalid crypto operation. No exploitation has been confirmed (not in CISA KEV) and EPSS is 0.02%, reflecting the narrow local-only attack surface.

Technical ContextAI

The vulnerability resides in the Linux kernel's AF_ALG subsystem (crypto/af_alg.c), which exposes the in-kernel cryptographic API to userspace via AF_ALG sockets. The specific function af_alg_get_rsgl() constructs RX scatterlists used by the skcipher (symmetric cipher) path during recvmsg processing. Prior to the fix, the function used af_alg_readable() purely as a binary gate - go or no-go - before extracting data into the scatterlist, rather than capping each extraction to the remaining af_alg_rcvbuf(sk) budget. This caused the receive-side accounting to drift from the amount of data actually attached to the crypto request. When skcipher could not obtain enough RX space for even one chunk but more data remained to process, the code would silently round the request length down to zero rather than returning an error to the caller. CWE is not formally assigned, but the root cause class most closely resembles CWE-682 (Incorrect Calculation) or CWE-400 (Uncontrolled Resource Consumption). Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. The upstream fix originates at commit e870456d8e7c8d57c059ea479b5aadbb55ff4c3a.

RemediationAI

The primary remediation is to upgrade to a patched Linux kernel version: 6.12.83, 6.18.24, 6.19.14, or 7.0. Upstream stable backport patches are available at https://git.kernel.org/stable/c/9bf3e6ccfdcfe56ae3190d1ae987dacf1cfef4f9, https://git.kernel.org/stable/c/07c6f6ffe29009426f0bd4d3cfbb6308b8ea8453, https://git.kernel.org/stable/c/4a264b2614c73c96666e196bbabe0cead52bdba7, and https://git.kernel.org/stable/c/8eceab19eba9dcbfd2a0daec72e1bf48aa100170. Ubuntu users should apply the fix per USN-8567-1 at https://ubuntu.com/security/notices/USN-8567-1; Red Hat and SUSE customers should consult their respective security channels. As a compensating control where patching is not immediately feasible, restrict unprivileged access to AF_ALG sockets by enforcing seccomp profiles that block AF_ALG socket creation, or apply AppArmor/SELinux policy denying the socket(AF_ALG, ...) syscall for untrusted user contexts - note this will break applications relying on userspace crypto acceleration via the kernel AF_ALG interface, such as certain OpenSSL engine configurations.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31677 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy