CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2026-05-01
EPSS: 98.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-22 · updated 2026-09-08
Weakness: CWE-669

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

Affected products

Amazon Linux: all versions
Arista Cloudvision Agni: from 2024.4.0 through 2025.2.2
Arista Networks CloudVision Portal: from 2024.2.0 through 2026.1.0
Arista Netvisor Os: before 7.1.0; 7.1.0, 7.1.0-hotfix7 — fixed in 7.1.0
Arista Networks VeloCloud Edge: from 4.5.0 through 6.4.1
Arista Networks VeloCloud Gateway: all versions
Arista Networks VeloCloud Orchestrator On-Prem: all versions
Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 20.04, 22.04, 24.04 (+1)
Debian Linux: 11.0, 12.0, 13.0
Linux kernel: from 4.14 before 5.10.254; from 5.11 before 5.15.204; from 5.16 before 6.1.170; from 6.2 before 6.6.137; from 6.7 before 6.12.85; from 6.13 before 6.18.22 — fixed in 5.10.254, 5.15.204, 6.1.170, 6.12.85, 6.18.22, 6.19.12
Nixos: before 25.11 — fixed in 25.11
openSUSE Leap: 15.3, 15.4, 15.5, 15.6
Red Hat Enterprise Linux: 8.0, 9.0, 10.0
RedHat Enterprise Linux Aus: 8.4, 8.6
RedHat Enterprise Linux Eus: 8.4, 9.4, 9.6, 10.0
RedHat Enterprise Linux Tus: 8.6, 8.8
RedHat Enterprise Linux Update Services For Sap Solutions: 8.6, 8.8, 9.0, 9.2
Red Hat OpenShift Container Platform 4.18: from 4.12 before 4.12.89; from 4.13 before 4.13.66; from 4.14 before 4.14.65; from 4.15 before 4.15.64; from 4.16 before 4.16.61; from 4.17 before 4.17.53 — fixed in 4.12.89, 4.13.66, 4.14.65, 4.15.64, 4.16.61, 4.17.53
Siemens Simatic Ax Runtime: all versions
Siemens SIMATIC CN 4100: before 6.0 — fixed in 6.0
Siemens Simatic Hmi Unified Comfort Panels Firmware: before 21.0; 21.0, 21.0-update_1, 21.0-update_2 — fixed in 21.0
Siemens Simatic Iot2050 Advanced Firmware: all versions
Siemens Simatic Ipc Ied-Os: all versions
Siemens Simatic S7-1500 Cpu 1518-4 Pn/Dp Mfp Firmware: from 3.1.5
Siemens Simatic S7-1500 Cpu 1518F-4 Pn/Dp Mfp Firmware: from 3.1.5
Siemens Simatic S7-1500 Tm Mfp Firmware: all versions
Siemens Siplus S7-1500 Cpu 1518-4 Pn/Dp Mfp Firmware: from 3.1.5
SUSE Basesystem Module: 15-sp1, 15-sp2, 15-sp3, 15-sp4, 15-sp5, 15-sp6 (+1)
SUSE CaaS Platform 4.5: 4.0
SUSE Development Tools Module: 15-sp1, 15-sp2, 15-sp3, 15-sp4, 15-sp5, 15-sp6 (+1)

How to fix

Upgrade to a fixed version: Arista Netvisor Os 7.1.0; Linux kernel 5.10.254, 5.15.204, 6.1.170, 6.12.85; Nixos 25.11; Red Hat OpenShift Container Platform 4.18 4.12.89, 4.13.66, 4.14.65, 4.15.64; Siemens SIMATIC CN 4100 6.0; Siemens Simatic Hmi Unified Comfort Panels Firmware 21.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-31431 or the next vulnerability affects your stack