Sign in Sign up
JA · EN · FR
SecPulse
Operating System
CVE-2026-31431 CISA KEV high CVSS 7.8

[KEV] Vulnerability in Linux redhat (CVE-2026-31431)

Operating System Cryptography Other

Summary

vulnerability in Linux redhat (CVE-2026-31431). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

crypto: algif_aead - Revert to operating out-of-place

This mostly reverts commit 72548b093ee3 except for the copying of
the associated data.

There is no benefit in operating in-place in algif_aead since the
source and destination come from different mappings. Get rid of
all the complexity added for in-place operation and just copy the
AD directly.

Source: CISA Known Exploited Vulnerabilities NVD GitHub Advisory CISA KEV

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

A critical vulnerability has been identified in the Linux kernel that allows unauthorized access by non-privileged users. This could result in system compromise if not patched promptly. Similar issues have been exploited before, emphasizing the importance of immediate action, especially in cloud services and corporate environments.

A vulnerability in the Linux kernel's algif_aead module allows unauthorized access through the AF_ALG API, enabling users to perform a 4-byte page cache write to any file. Affected versions range from 4.14, with fixes in 6.18.22 and 6.19.12. As a workaround, adding "install algif_aead /bin/false" to /etc/modprobe.d/disable-algif-aead.conf can disable the kernel module.

❓ What is the problem

Vulnerability in the Linux kernel's algif_aead encryption module allowing unauthorized page cache writes.

📍 Affected scope

AF_ALG API, algif_aead module of the Linux kernel.

🔥 Severity

High severity vulnerability with potential for privilege escalation to root.

🔧 How to fix

Patch kernels to version 6.19.12 or apply backported fixes. Disable algif_aead module as a workaround.

🛡️ Workaround

Disable algif_aead kernel module by setting "install algif_aead /bin/false" in /etc/modprobe.d/disable-algif-aead.conf.

🔍 Detection

Detection can be done by inspecting kernel versioning and system logs for unauthorized kernel module usage.

Related past incidents Similar incidents extracted from past CVEs

CVE-2022-0847 (Dirty Pipe)

A similar privilege escalation vulnerability in Linux, allowing bypass of file checks to gain root access.

CVE-2016-5195 (Dirty COW)

A famous Linux privilege escalation bug leveraging a race condition for root access.

CVE-2023-24592

A vulnerability in Linux kernel affecting cryptographic subsystem, similar in usage of page cache.

If this happens at your company Expected impact per business scenario

📌 Cloud-hosted SaaS servers

Unauthorized users may escalate privileges, affecting data integrity and system security.

📌 Corporate multi-user environments

Compromised user accounts could lead to broader network access and data breaches.

📌 CI/CD pipelines with shared system resources

Malicious actors could alter build processes, impacting software integrity.

Recommended action

Immediately apply available patches and ensure kernel modules like algif_aead are disabled if not actively used.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'redhat' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で redhat を grep し、稼働しているサービス・バージョンを把握する。

  2. 4
    Consider incident declaration escalate 
    Notify SOC / on-call

    CISA KEV登録済 = 実環境で悪用が観測されている。Step 3 で兆候があればインシデント対応宣言、無くてもパッチ適用までWAF強化を最優先で。

  3. 7
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Fix status by distribution

Fixed packages published by each distribution for this CVE

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details