It affects the algif_aead cryptographic interface and can let a low-privileged local attacker gain root privileges.Red Hat assigns CVSS 3.1 7.8 High and rates the issue Important for its products because exploitation requires local access. CISA added the flaw to its Known Exploited Vulnerabilities catalog on May 1, 2026.
What it allows
How Does CVE-2026-31431 Copy Fail Work?
Red Hat says an incorrect in-place operation makes source and destination data mappings differ during cryptographic processing. The resulting inconsistency can let a local attacker corrupt sensitive system files and escalate to root.
The upstream correction returns the operation to out-of-place processing. This removes the unsafe mapping behavior instead of retaining the optimization that introduced it.
Why Does CVE-2026-31431 Require Priority?
CISA lists CVE-2026-31431 as actively exploited and required US federal agencies to remediate it by May 15, 2026. CERT-EU also reported a public proof of concept when it published its advisory.
Our November 9 GitHub search returned 346 repositories matching the CVE identifier. We did not run or link any repository, and teams should treat unverified exploit tooling as hostile.
Who is affected
Which Linux Kernel Versions Are Affected by CVE-2026-31431?
NVD lists affected kernel branches from 4.14 through 7.0. Fixed boundaries are 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.22, and 6.19.12.
The affected ranges are 4.14 to before 5.10.254, 5.11 to before 5.15.204, and 5.16 to before 6.1.170. They also include 6.2 to before 6.6.137 and 6.7 to before 6.12.85.
NVD additionally lists 6.13 to before 6.18.22, 6.19 to before 6.19.12, and kernel 7.0. Distribution backports can change exposure, so administrators should use their vendor's advisory and package status.
CERT-EU directly verified affected builds on Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16. It prioritizes Kubernetes nodes and CI/CD runners that process untrusted workloads.
What to do
-
Apply the distribution's fixed kernel
Install the kernel update supplied by the Linux distributor and reboot into it. Confirm the running kernel, because an installed update does not protect a host before reboot.
-
Prioritize shared compute
Patch Kubernetes nodes, CI/CD runners, and multi-user Linux systems first. CERT-EU prioritizes systems that expose local execution to untrusted workloads.
-
Use the vendor mitigation when patching is delayed
Follow the distribution advisory to disable the affected interface or block its use by untrusted workloads. Test compatibility because applications explicitly using the interface may be affected.
-
Hunt for unexpected privilege changes
Review telemetry for low-privileged processes that unexpectedly gain root access. Correlate those events with activity on unpatched Linux hosts and preserve evidence for investigation.
Frequently Asked Questions
What is CVE-2026-31431?
It is a local privilege escalation flaw in the Linux kernel's algif_aead cryptographic interface. A low-privileged local attacker may corrupt sensitive files and gain root privileges.
Is CVE-2026-31431 actively exploited?
Yes. CISA added CVE-2026-31431 to its Known Exploited Vulnerabilities catalog on May 1, 2026. CERT-EU also reported a public proof of concept.
What is the CVSS score for CVE-2026-31431?
Red Hat and the CVE record assign CVSS 3.1 7.8 High. No CVSS 4.0 score appears in the Red Hat or NVD records included here.
How should organizations remediate CVE-2026-31431?
Install the fixed kernel from the Linux distributor, reboot the host, and verify the running version. Prioritize Kubernetes nodes, CI/CD runners, and shared Linux systems.
Sources
- Red Hat: CVE-2026-31431Red Hat
- CERT-EU Security Advisory 2026-005cert.europa.eu
- NVD: CVE-2026-31431NIST NVD
- CISA Known Exploited Vulnerabilities CatalogCISA
