MSRXVulnerabilities / CVE-2026-31431
CVE-2026-31431
Published 2026-04-22 · published (not yet in NVD)
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
Exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-01, with a fix-by date of 2026-05-15. Patch it first.
"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
7.8 HIGH
CVSS 3.1 · CNA
CVSS 3.1 · CNA
98%
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
Scores
Affected packages and fixed versions
| Package | Ecosystem | Fixed in |
|---|---|---|
| Kernel | Linux | 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.22, 6.19.12 |
Affected products
- Linux Linux: 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 to < 893d22e0135fa394db81df88697fba6032747667; 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 to < 19d43105a97be0810edbda875f2cd03f30dc130c; 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 to < 961cfa271a918ad4ae452420e7c303149002875b; 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 to < 3115af9644c342b356f3f07a4dd1c8905cd9a6fc; 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 to < 8b88d99341f139e23bdeb1027a2a3ae10d341d82; 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 to < fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8; 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 to < ce42ee423e58dffa5ec03524054c9d8bfd4f6237; 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 to < a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5
- Linux Linux: 4.14
8 references (advisories, patches, write-ups)
- https://git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667
- https://git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130c
- https://git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875b
- https://git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fc
- https://git.kernel.org/stable/c/8b88d99341f139e23bdeb1027a2a3ae10d341d82
- https://git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8
- https://git.kernel.org/stable/c/ce42ee423e58dffa5ec03524054c9d8bfd4f6237
- https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5
Sources: CVE.org, OSV.dev, FIRST EPSS. Missing ones did not answer or have no record yet.