Known exploited vulnerability
CVE-2026-31431
The short answer
CVE-2026-31431 affects Linux Linux and is rated high (CVSS 7.8). CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-01: attackers are using it, so patch it first. The vendor has linked a patch.
What it is
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
Severity
7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploited (CISA KEV)
Yes, since May 1, 2026
Federal due date May 15, 2026
EPSS, next 30 days
98%
Higher than 100% of scored CVEs
How it can be exploited
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality impact
- High
- Integrity impact
- High
- Availability impact
- High
What CISA says to do
"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
Linux, NVIDIA for RHEL 10, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions. NVD's record lists the exact affected versions.
References
- git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130c Patch
- git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fc Patch
- git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667 Patch
- git.kernel.org/stable/c/8b88d99341f139e23bdeb1027a2a3ae10d341d82 Patch
- git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875b Patch
- git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5 Patch
- git.kernel.org/stable/c/ce42ee423e58dffa5ec03524054c9d8bfd4f6237 Patch
- git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8 Patch
- copy.fail Exploit
- websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170 ExploitThird Party Advisory
- www.kb.cert.org/vuls/id/260001 Third Party Advisory
- access.redhat.com/errata/RHSA-2026:13565 Third Party Advisory
Questions
Is CVE-2026-31431 being exploited?
Yes. CISA added CVE-2026-31431 to its Known Exploited Vulnerabilities catalog on 2026-05-01, with a federal remediation due date of 2026-05-15.
How do I fix CVE-2026-31431?
CISA's required action: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
From NVD, CISA KEV, FIRST EPSS and OSV.dev, checked . Status on NVD: Analyzed. The description is NVD's text, quoted as published.
Related
Latest CVEs this week
Critical and High CVEs from the last 7 days, with KEV and EPSS.
Exploited vulnerabilities by vendor
Every vendor in CISA's KEV catalog, with its count.
Linux exploited vulnerabilities
Everything CISA lists as exploited for Linux.
Vulnerability watch
A briefing and a fix pull request when an advisory hits your dependencies.
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.