CVE-2026-31431
Suse Linux Enterprise Server 11 … 16.1
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-31431 is a high-severity Incorrect Resource Transfer Between Spheres (CWE-669) vulnerability in Suse Linux Enterprise Server. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Escape to Host (T1611); ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability resolved in CVE-2026-31431 affects the Linux kernel's crypto subsystem, specifically the algif_aead interface used for AEAD cipher operations via the AF_ALG socket family. The issue stems from commit 72548b093ee3, which introduced in-place operation handling; because source and destination buffers originate from separate memory mappings, this added unnecessary complexity around buffer management and associated data handling, classified under CWE-669.
Local users with access to the AF_ALG interface can exploit the flaw to achieve high-impact effects on confidentiality, integrity, and availability. An attacker able to supply crafted AEAD requests can leverage the in-place logic to corrupt or disclose kernel memory regions involved in cryptographic processing.
The referenced stable kernel commits revert the in-place changes while retaining direct copying of associated data, restoring out-of-place operation to eliminate the problematic code paths. These patches have been applied across multiple maintained branches.
EPSS scores rose from a low baseline to a recorded peak of 0.0406, indicating emerging exploitation interest after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24639
Vulnerability Data
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since…
more
the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
- CWE(s)
- KEV Date Added
- 01 May 2026
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 2 OS baselines
V2.2.2V4.2.3V12.3.2
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved information flow authorizations between system components and connected systems, directly stopping improper resource transfers across spheres.
Prevents unintended information leakage through shared system resources when crossing sphere boundaries.
Monitors and controls communications at external and key internal boundaries to block unauthorized transfers between trust domains.
SI-10 requires validity checks on supplied inputs, directly stopping acceptance of internally inconsistent complex data.
Enforces logical access authorizations that limit resource transfers to only approved sphere crossings.
Separates user functionality from system management functions to avoid improper resource or behavior transfer between privilege spheres.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Least-privilege authorization policies directly constrain resource transfers across security domains.
Secure SDLC practices directly require consistency validation for complex inputs.
Protecting data-in-transit can limit exposure during inter-sphere transfers but does not address control-flow or authorization errors.
Logical segmentation and access controls reduce unintended cross-sphere resource movement.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect consistency flaws but does not prevent them at design time.
Environment separation limits unintended resource leakage between spheres.
Information-transfer rules can prevent improper resource hand-off between spheres.
Access-control policies limit unintended control over transferred resources.
Managing access rights reduces risk of unauthorized resource transfer.
Network-security controls can block improper cross-sphere transfers.