7.8
High
CVE-2026-31431 Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns
Not observed so far
Weakness
CWE-669
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux 7.0 | earliest → < 7.0 | 7.0 |
| Linux 6.19 | earliest → < 6.19.12 | 6.19.12 |
| Linux 6.18 | earliest → < 6.18.22 | 6.18.22 |
| Linux 6.12 | earliest → < 6.12.85 | 6.12.85 |
| Linux 6.6 | earliest → < 6.6.137 | 6.6.137 |
| Linux 6.1 | earliest → < 6.1.170 | 6.1.170 |
| Linux 5.15 | earliest → < 5.15.204 | 5.15.204 |
| Linux 5.10 | earliest → < 5.10.254 | 5.10.254 |
| Linux | 4.14 | No fix stated |
Show the 142 other branches Hide the 142 other branches
Other CVEs of Linux
The 18300 CVEs of Linux →
CVE-2026-99284
net: skbuff: propagate shared-frag marker in skb_zerocopy()
Not rated
CVE-2026-99283
netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
Not rated
CVE-2026-99279
ksmbd: reclaim ended sessions on logoff and expiration
Not rated
CVE-2026-99282
net/sched: sch_teql: fix use-after-free on lower qdisc drop
Not rated