Security readout for executives and security teams
Plain-English summary
CVE-2026-31431 is a high-severity Linux kernel flaw in the AEAD crypto socket path. A local user may be able to compromise confidentiality, integrity, and availability. CISA KEV listing indicates known exploitation, so Linux servers and endpoints should be prioritized for kernel update review.
Executive priority
Treat as urgent for Linux environments because exploitation is KEV-listed and impact is high. Patch prioritization should focus on shared systems, production servers, and environments where attackers could gain low-privileged local access after initial compromise.
Technical view
The issue is in Linux kernel crypto/algif_aead behavior introduced by in-place operation complexity. The kernel fix reverts to out-of-place operation and copies associated data directly. CVSS 3.1 is 7.8: local attack vector, low complexity, low privileges, no user interaction, high CIA impact.
Likely exposure
Exposure is primarily Linux systems running affected kernel builds with the vulnerable algif_aead code. Multi-user systems, shared compute, containers with local user access, and internet-facing servers with post-compromise local footholds deserve priority. Exact distribution impact should be confirmed through vendor advisories.
Exploitation context
CISA lists CVE-2026-31431 in the Known Exploited Vulnerabilities catalog. The source bundle also includes a public exploit-tagged repository, but this assessment does not rely on or describe exploit mechanics. Treat this as a local privilege/post-compromise risk with confirmed real-world relevance.
Researcher notes
The public record points to a kernel-level regression around algif_aead in-place handling. Source data names stable commit references and affected Linux entries, but exact distribution package versions require vendor confirmation. Avoid assuming exposure from upstream version numbers alone.
Mitigation direction
- Apply Linux kernel updates from your distribution or kernel vendor.
- Prioritize systems with untrusted local users or shared workloads.
- Verify updates include the referenced stable kernel fixes.
- Review Red Hat and other vendor-specific guidance for package status.
- If patching is delayed, reduce local shell access where possible.
Validation and detection
- Inventory Linux kernel versions across servers, endpoints, and images.
- Map installed kernels to vendor advisories for CVE-2026-31431.
- Check whether deployed kernels include the referenced stable commits.
- Confirm CISA KEV tracking in vulnerability management workflows.
- Retest after reboot to ensure patched kernels are running.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1288: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-669: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-31431 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Reported to Red Hat.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2026-31431 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-05-01T00:00:00.000Z: CVE-2026-31431 added to CISA KEV
- 2026-04-22T00:00:00.000Z: Reported to Red Hat.
- 2026-04-22T00:00:00.000Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667CVE reference, Linux
- https://git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130cCVE reference, Linux
- https://git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875bCVE reference, Linux
- https://git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fcCVE reference, Linux
- https://git.kernel.org/stable/c/8b88d99341f139e23bdeb1027a2a3ae10d341d82CVE reference, Linux
- https://git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8CVE reference, Linux
- https://git.kernel.org/stable/c/ce42ee423e58dffa5ec03524054c9d8bfd4f6237CVE reference, Linux
- https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5CVE reference, Linux
- https://github.com/theori-io/copy-fail-CVE-2026-31431CVE reference, CISA-ADP · exploit
- https://xint.io/blog/copy-fail-linux-distributions#the-fix-6CVE reference, CISA-ADP · mitigation
- https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/CVE reference, CISA-ADP · mitigation
- https://access.redhat.com/security/cve/cve-2026-31431#cve-details-mitigationCVE reference, CISA-ADP · mitigation
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-31431CVE reference, CISA-ADP · government-resource
- https://copy.fail/CVE reference, CVE
- https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170CVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlsiemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlsiemens-SADP
- https://access.redhat.com/security/cve/CVE-2026-31431redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2460538redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31431.jsonredhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:14926redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33486redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:14097redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Validation of Consistency within Input
Improper Validation of Consistency within Input represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Incorrect Resource Transfer Between Spheres
Incorrect Resource Transfer Between Spheres represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.