CVE-2026-31431

Katalog CVE

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 3,4%

Kerentanan Incorrect Resource Transfer Between Spheres pada linux kernel, redhat openshift container platform +13 lainnya. Skor CVSS 3.1 7.8 (High) menurut CNA. Masuk katalog KEV CISA pada 1 Mei 2026, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

Rincian

Terbit di NVD

22 April 2026

Terakhir diubah

8 September 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber CNA
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-669: Incorrect Resource Transfer Between Spheres
CWE-1288: Improper Validation of Consistency within Input

EPSS (30 hari)

3,4% peluang dieksploitasi; lebih tinggi dari 88,6% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

Masuk KEV

1 Mei 2026

Tenggat CISA

15 Mei 2026 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 169 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/ advisory vendor
• https://git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130c patch
• https://git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fc patch
• https://git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667 patch
• https://git.kernel.org/stable/c/8b88d99341f139e23bdeb1027a2a3ae10d341d82 patch
• https://git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875b patch
• https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5 patch
• https://git.kernel.org/stable/c/ce42ee423e58dffa5ec03524054c9d8bfd4f6237 patch
• https://git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8 patch
• http://www.openwall.com/lists/oss-security/2026/04/29/23 exploit · mailing list · patch
• http://www.openwall.com/lists/oss-security/2026/04/29/25 mailing list · patch
• http://www.openwall.com/lists/oss-security/2026/04/29/26 exploit · mailing list · patch
• http://www.openwall.com/lists/oss-security/2026/04/30/10 mailing list · patch
• http://www.openwall.com/lists/oss-security/2026/04/30/11 mailing list · patch
• http://www.openwall.com/lists/oss-security/2026/04/30/12 mailing list · patch
• http://www.openwall.com/lists/oss-security/2026/04/30/14 mailing list · patch
• http://www.openwall.com/lists/oss-security/2026/04/30/15 mailing list · patch
• http://www.openwall.com/lists/oss-security/2026/04/30/16 mailing list · patch
• http://www.openwall.com/lists/oss-security/2026/04/30/5 exploit · mailing list · patch
• https://xint.io/blog/copy-fail-linux-distributions#the-fix-6 exploit · patch · advisory pihak ketiga
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-31431 pemerintah AS
• https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170 exploit · advisory pihak ketiga
• https://www.kb.cert.org/vuls/id/260001 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:13565 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:13566 advisory pihak ketiga