Secuno
ENNL
Book demo

CVE-2026-31431

Linux Kernel Incorrect Resource Transfer Between Spheres

7.8 HIGHActively exploited (CISA KEV)Public exploitEPSS 3.44%
  1. Published22 Apr 2026
  2. Added to CISA KEV1 May 2026
  3. Remediation due15 May 2026
Actively exploited (CISA KEV)

Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.

Added to KEV: 1 May 2026Federal remediation due: 15 May 2026

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

CVSS 3.1 breakdown

Attack vectorLocal
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Arista Cloudvision Agni≥ 2024.4.0 ≤ 2025.2.2
Arista Cloudvision Portal≥ 2024.2.0 ≤ 2026.1.0
Arista Velocloud Edge≥ 4.5.0 ≤ 6.4.1
Arista Velocloud Gatewayall versions
Arista Velocloud Orchestratorall versions
Redhat Openshift Container Platform≥ 4.12 < 4.12.89 · ≥ 4.13 < 4.13.66 · ≥ 4.14 < 4.14.65 · ≥ 4.15 < 4.15.64
Siemens Simatic Ax Runtimeall versions
Suse Caas Platform4.0
Suse Enterprise Storage6.0 · 7.0 · 7.1
Suse Manager Proxy4.0 · 4.1 · 4.2 · 4.3
Suse Manager Retail Branch Server4.0 · 4.1 · 4.2 · 4.3
Suse Manager Server4.0 · 4.1 · 4.2 · 4.3
Suse Openstack Cloud9.0
Suse Openstack Cloud Crowbar9.0
Amazon Linuxall versions
Arista Netvisor OS< 7.1.0 · 7.1.0
Canonical Ubuntu Linux14.04 · 16.04 · 18.04 · 20.04
Debian Linux11.0 · 12.0 · 13.0
Linux Kernel≥ 4.14 < 5.10.254 · ≥ 5.11 < 5.15.204 · ≥ 5.16 < 6.1.170 · ≥ 6.13 < 6.18.22
Nixos< 25.11
Opensuse Leap15.3 · 15.4 · 15.5 · 15.6
Redhat Enterprise Linux10.0 · 8.0 · 9.0
Redhat Enterprise Linux Aus8.4 · 8.6
Redhat Enterprise Linux Eus10.0 · 8.4 · 9.4 · 9.6

Remediation

Fixed in
Redhat Openshift Container Platform≥ 4.12.89
Arista Netvisor OS≥ 7.1.0
Linux Kernel≥ 5.10.254
Nixos≥ 25.11
Siemens Simatic Cn 4100 Firmware≥ 6.0
Siemens Simatic Hmi Unified Comfort Panels Firmware≥ 21.0

References

and 117 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-201949.1
As part of Cisco's ongoing commitment to proactive security and product quality, the…
CVE-2026-187948.2
The OpenRGB network protocol allows attackers to cause memory exhaustion and…
CVE-2026-141518.3
Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a…
CVE-2026-317098.8
In the Linux kernel, the following vulnerability has been resolved: smb: client:…
CVE-2025-416608.8
A low-privileged remote attacker may be able to replace the boot application of the…
CVE-2026-247088.2
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32…

Frequently asked

Is CVE-2026-31431 being actively exploited?

Yes. CVE-2026-31431 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 1 May 2026.

How severe is CVE-2026-31431?

CVE-2026-31431 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 3.44% probability of exploitation.

Which products are affected by CVE-2026-31431?

Affected products include Arista Cloudvision Agni, Arista Cloudvision Portal, Arista Velocloud Edge, Arista Velocloud Gateway, Arista Velocloud Orchestrator, and 19 more.

How do I fix CVE-2026-31431?

Upgrade affected software to a fixed version, for example Redhat Openshift Container Platform 4.12.89, Arista Netvisor OS 7.1.0, Linux Kernel 5.10.254 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-31431 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.