CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on , 9 days after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 98.1%
EPSS score, percentile 99.9 of all scored records
- How severe?
- 7.8 High
CVSS v3.1 base score, given by the CNA
- What should I do?
CISA deadline . "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Affected
- 4.14
Unaffected before 4.14; 5.10.254; 5.15.204; 6.1.170; 6.6.137; 6.12.85; and 3 more
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
What to do
Required action, set by CISA
"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date for this action: .
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
Linked from CISA's catalog entry
- https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/
- https://xint.io/blog/copy-fail-linux-distributions#the-fix-6
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/about/
- https://nvd.nist.gov/vuln/detail/CVE-2026-31431
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | from 72548b093ee3 to before 893d22e0135f |
| Affected | from 72548b093ee3 to before 19d43105a97b |
| Affected | from 72548b093ee3 to before 961cfa271a91 |
| Affected | from 72548b093ee3 to before 3115af9644c3 |
| Affected | from 72548b093ee3 to before 8b88d99341f1 |
| Affected | from 72548b093ee3 to before fafe0fa2995a |
| Affected | from 72548b093ee3 to before ce42ee423e58 |
| Affected | from 72548b093ee3 to before a664bf3d603d |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | 4.14 |
| Unaffected | before 4.14 |
| Unaffected | 5.10.254 |
| Unaffected | 5.15.204 |
| Unaffected | 6.1.170 |
| Unaffected | 6.6.137 |
| Unaffected | 6.12.85 |
| Unaffected | 6.18.22 |
| Unaffected | 6.19.12 |
| Unaffected | 7.0 |
Versions not listed are: affected.
Versions the record lists as unaffected: 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.22, 6.19.12, 7.0.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
About this vulnerability
Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.
Summary: CISA's KEV catalog, as of .
- CISA added CVE-2026-31431 to its Known Exploited Vulnerabilities (KEV) catalog on 1 May 2026.
- CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
- The due date CISA sets for the required action is 15 May 2026.
- The CVE record was published on 22 Apr 2026, 9 days before it was added to KEV.
- The CVE record carries a CVSS v3.1 base score of 7.8 (High), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 98.1% (percentile 99.9), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.
Description
crypto: algif_aead - Revert to operating out-of-place
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
Weakness
- CWE-669: Incorrect Resource Transfer Between Spheres
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| Added to CISA KEV | |
| CISA due date for the required action | |
| CVE record last updated |
References
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
More exploited Linux vulnerabilities
- CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability
- CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
- CVE-2025-39964: Linux Kernel Race Condition Vulnerability
- CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability
- CVE-2026-53362: Linux Kernel Unspecified Vulnerability
- CVE-2022-0995: Linux Kernel Out-of-Bounds Write Vulnerability