CVE-2026-31431
Linux Kernel: Incorrect Resource Transfer Between Spheres
As of , CVE-2026-31431 in Linux Kernel is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.
- Exploited
- Yes: CISA listed it on 1 May 2026
- US federal deadline
- 15 May 202614 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- EPSS score
- 0.03Higher than 88% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- Public exploit
- 1 Metasploit module
- Fix
- Vendor advice: git.kernel.org, lore.kernel.org and xint.ioLinks below, from CISA's entry.
What CISA says to do
"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA's required action
What the flaw is
Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.
CISA's description
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
The CVE record's description, from Linux
- CVE published
- 22 April 2026
- Assigned by
- Linux
- CVSS
- 7.8 High (CVSS 3.1, from the CNA)
- CWE-669
- Incorrect Resource Transfer Between Spheres
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- no
- CISA SSVC, technical impact
- total
Timeline
- The CVE record was published.
- CISA added it to its list of exploited vulnerabilities.
- CISA changed its entry. Edited: weakness list.
- The US federal deadline to fix it.
Public exploits
Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.
- Metasploit: Copy Fail AF_ALG + authencesn Page-Cache Writeexploit module, rank excellent
Kernel: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2025-39682Improper Check for Unusual or Exceptional Conditions | Linux Kernel | Patch nowForensic triage required by CISA | 0.03 | ||
| CVE-2025-39964Race Condition | Linux Kernel | Patch nowForensic triage required by CISA | 0.01 | ||
| CVE-2026-53266Out-of-Bounds Write | Linux Kernel | Patch nowForensic triage required by CISA | 0.01 | ||
| CVE-2026-53362Unspecified | Linux Kernel | Patch nowForensic triage required by CISA | 0.01 | ||
| CVE-2021-22555Heap Out-of-Bounds Write | Linux Kernel | Patch this weekMetasploit module; EPSS 0.79; verified Exploit-DB entry | 0.79 | ||
| CVE-2013-6282Improper Input Validation | Linux Kernel | Patch this weekMetasploit module; verified Exploit-DB entry | 0.40 | ||
| CVE-2019-13272Improper Privilege Management | Linux Kernel | Patch this weekMetasploit module; EPSS 0.52; verified Exploit-DB entry | 0.52 | ||
| CVE-2010-3904Improper Input Validation | Linux Kernel | Patch this weekMetasploit module; verified Exploit-DB entry | 0.16 | ||
| CVE-2022-0847Privilege Escalation | Linux Kernel | Patch this weekMetasploit module; EPSS 0.93 | 0.93 | ||
| CVE-2021-3493Privilege Escalation | Linux Kernel | Patch this weekMetasploit module | 0.49 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org