HIGH Actively exploited CWE-669
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
Linux·Kernel
7.8/ 10
CVSS 3.1
High severity
98%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 99.9% of all CVEs
Listed
CISA KEV catalog
- Added
- May 1, 2026
- Fix due
- May 15, 2026
- Ransomware
- Not known
Timeline
- Published
- Apr 22, 2026
- Updated
- Oct 15, 2026
- First covered
- Jul 4, 2026
- Latest story
- 4 months ago
Summary
In the Linux kernel, the following vulnerability has been resolved:crypto: algif_aead - Revert to operating out-of-placeThis mostly reverts commit 72548b093ee3 except for the copying of the associated data.There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
CWE-669Incorrect Resource Transfer Between Spheres
Attack profile
Attack vectorLocal
ComplexityLow
PrivilegesLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCISA required action
"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
- Linux72548b093ee38a6d4f2a19e6ef1948ae05c181f7 to before 893d22e0135fa394db81df88697fba603274766772548b093ee38a6d4f2a19e6ef1948ae05c181f7 to before 19d43105a97be0810edbda875f2cd03f30dc130c72548b093ee38a6d4f2a19e6ef1948ae05c181f7 to before 961cfa271a918ad4ae452420e7c303149002875b72548b093ee38a6d4f2a19e6ef1948ae05c181f7 to before 3115af9644c342b356f3f07a4dd1c8905cd9a6fc
- Linux4.14