Vulnpedia
← All CVEs

CVE-2026-31431

HIGH 7.8 KNOWN EXPLOITED PoC CATALOGUED DETECTION TEMPLATE ALL-YEARS

Published 2026-04-22 · Last modified 2026-10-15 · Linux · NVD: Analyzed

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

ACTIVELY EXPLOITED

Confirmed exploited in the wild — in CISA KEV since 2026-05-01. Patch or mitigate now.

Exploitation likelihood

98.1%chance of exploitation in 30 days · 100th percentile

● In CISA KEV (2026-05-01)● Catalogued PoC◆ SSVC: exploitation active, automatable no

Impact if exploited

7.8CVSS 3.1 · HIGH · CNA

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ⚠Access: Requires local access to the host
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

Public PoC or exploit resources are catalogued below.

Listed by the named source; Vulnpedia has not tested these resources.

PoC data: JSON

Detection templates

Detection checks are listed separately from PoCs.

Resource commands

nuclei -id CVE-2026-31431 -u https://TARGETDetection template — review its checks and affected versions before use.
curl -s https://vulnpedia.com/cve/CVE-2026-31431/poc.jsonMachine-readable PoC index for this CVE (for automation).

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Linux Siemens Red Hat Redhat Amazon Canonical Debian Opensuse Suse Nixos Arista

Products Linux Simatic Ax Runtime Core Linux Common Debian Simatic Ax Runtime Core Linux Common Debian Arm64 Simatic Ax Runtime Core Linux Platform Container Common Debian Development Simatic Ax Runtime Core Linux Vmware Development Simatic Cn 4100 Simatic Hmi Mtp1000 Unified Basic Simatic Hmi Mtp1000 Unified Comfort Panel Simatic Hmi Mtp1000 Unified Comfort Panel Hygienic Simatic Hmi Mtp1000 Unified Comfort Panel Hygienic Neutral Design Simatic Hmi Mtp1000, Unified Comfort Panel Neutral Simatic Hmi Mtp1200 Comfort Pro For Stand (Expandable, Flange At The Bottom) Simatic Hmi Mtp1200 Comfort Pro For Support Arm (Expandable, Round Tube) And Extension Unit Simatic Hmi Mtp1200 Comfort Pro For Support Arm (Not Extendable, Flange On Top) Simatic Hmi Mtp1200 Comfort Pro Neutral Design For Stand (Expandable, Flange At The Bottom) Simatic Hmi Mtp1200 Comfort Pro Neutral Design For Support Arm (Expandable, Round Tube) And Extension Simatic Hmi Mtp1200 Comfort Pro Neutral Design For Support Arm (Not Extendable, Flange On Top) Simatic Hmi Mtp1200 Unified Basic Simatic Hmi Mtp1200 Unified Comfort Panel Simatic Hmi Mtp1200 Unified Comfort Panel Hygienic Simatic Hmi Mtp1200 Unified Comfort Panel Hygienic Neutral Design Simatic Hmi Mtp1200 Unified Comfort Panel Neutral Design Simatic Hmi Mtp1500 Comfort Pro For Stand (Expandable, Flange At The Bottom) Simatic Hmi Mtp1500 Comfort Pro For Support Arm (Expandable, Round Tube) And Extension Unit Simatic Hmi Mtp1500 Comfort Pro For Support Arm (Not Extendable, Flange On Top) Simatic Hmi Mtp1500 Comfort Pro Neutral Design For Stand (Expandable, Flange At The Bottom) Simatic Hmi Mtp1500 Comfort Pro Neutral Design For Support Arm (Expandable, Round Tube) And Extension Simatic Hmi Mtp1500 Comfort Pro Neutral Design For Support Arm (Not Extendable, Flange On Top) Simatic Hmi Mtp1500 Unified Comfort Panel Simatic Hmi Mtp1500 Unified Comfort Panel Hygienic Simatic Hmi Mtp1500 Unified Comfort Panel Hygienic Neutral Design Simatic Hmi Mtp1500 Unified Comfort Panel Neutral Design Simatic Hmi Mtp1900 Comfort Pro For Stand (Expandable, Flange At The Bottom) Simatic Hmi Mtp1900 Comfort Pro For Support Arm (Expandable, Round Tube) And Extension Unit Simatic Hmi Mtp1900 Comfort Pro For Support Arm (Not Extendable, Flange On Top) Simatic Hmi Mtp1900 Comfort Pro Neutral Design For Stand (Expandable, Flange At The Bottom) Simatic Hmi Mtp1900 Comfort Pro Neutral Design For Support Arm (Expandable, Round Tube) And Extension Simatic Hmi Mtp1900 Comfort Pro Neutral Design For Support Arm (Not Extendable, Flange On Top) Simatic Hmi Mtp1900 Unified Comfort Panel Simatic Hmi Mtp1900 Unified Comfort Panel Hygienic

Weakness (CWE)

  • CWE-669: Incorrect Resource Transfer Between Spheres
  • CWE-1288: Improper Validation of Consistency within Input

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References and research data (JSON)

Vendor product assessments

Showing 32 of 3318 vendor product statements; 3286 omitted. Read the full vendor advisory.

  • kernel-0:6.12.0-211.6.el10nv.aarch64 as a component of NVIDIA for RHEL 10 · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-debug-devel-matched-0:6.12.0-124.55.1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-devel-0:5.14.0-284.169.1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-rt-debug-debuginfo-0:5.14.0-611.54.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • python3-perf-debuginfo-0:6.12.0-55.71.1.el10_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_0?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • python3-perf-debuginfo-0:6.12.0-211.7.3.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-0:4.18.0-372.191.1.el8_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_6?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kpatch-patch-4_18_0-477_97_1-debuginfo-0:1-8.el8_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-modules-0:5.14.0-284.169.1.el9_2.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • python3-perf-0:5.14.0-427.124.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_4?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-tools-libs-0:5.14.0-611.54.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • libperf-debuginfo-0:6.12.0-124.55.1.el10_1.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-debuginfo-0:5.14.0-687.5.3.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • libperf-debuginfo-0:5.14.0-611.54.1.el9_7.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-rt-debug-modules-0:5.14.0-70.178.1.rt21.250.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.0) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_0?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • python3-perf-debuginfo-0:5.14.0-687.5.3.el9_8.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel

    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-debug as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-debug

    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-devel as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-devel

    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-headers as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-headers

    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel.src as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel?arch=src

    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • bpftool as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/bpftool

    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-abi-whitelists as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-abi-whitelists

    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-debug-devel as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-debug-devel

    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-headers as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-headers

    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-rt as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-rt

    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-rt-debug-devel as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-rt-debug-devel

    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-rt-doc as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-rt-doc

    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-rt-trace-devel as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-rt-trace-devel

    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-tools as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-tools

    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • kernel-tools-libs-devel as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-tools-libs-devel

    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00
  • python-perf as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/python-perf

    Red Hat · CVE-2026-31431 · Updated 2026-10-09T01:04:15+00:00

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

326 candidates

Additional exploitation reports

Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.

All CVSS metrics

  • HIGH 7.8 v3.1 · CNA Primary
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • HIGH 7.8 v3.1 · ADP Primary
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • HIGH 7.8 v3.1 · NVD Secondary
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Exploit-tagged references (not proof of a PoC)

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS