CVE-2026-31431
Published: 22 April 2026
Summary
CVE-2026-31431 is a high-severity Incorrect Resource Transfer Between Spheres (CWE-669) vulnerability in Suse Linux Enterprise Server. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 14.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the vulnerability by requiring timely application of Linux kernel patches that revert the unnecessary in-place operation in algif_aead.
Enables identification of systems affected by CVE-2026-31431 through regular vulnerability scanning of kernel versions.
Mitigates potential memory corruption from improper in-place operations on different mappings via mechanisms like ASLR and non-executable memory.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel vulnerability in crypto subsystem with low-priv attacker and full C/I/A impact directly enables T1068 (Exploitation for Privilege Escalation).
NVD Description
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since…
more
the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
Deeper analysisAI
CVE-2026-31431 is a vulnerability in the Linux kernel's crypto/algif_aead component, stemming from an unnecessary in-place operation introduced in commit 72548b093ee3. The fix reverts to out-of-place operation, retaining only the copying of associated data, as source and destination buffers originate from different mappings, providing no performance benefit while adding complexity. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-669.
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation enables high-impact disruption to confidentiality, integrity, and availability.
Mitigation involves applying the stable kernel patches referenced in the following commits: 19d43105a97be0810edbda875f2cd03f30dc130c, 3115af9644c342b356f3f07a4dd1c8905cd9a6fc, 893d22e0135fa394db81df88697fba6032747667, 8b88d99341f139e23bdeb1027a2a3ae10d341d82, and 961cfa271a918ad4ae452420e7c303149002875b, available via git.kernel.org.
Details
- CWE(s)
- KEV Date Added
- 01 May 2026