CVE-2026-31431
published 2026-04-22CVE-2026-31431: In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit…
PriorityP189high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-05-15
Exploited in the wild
EPSS
94.55%
99.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
crypto: algif_aead - Revert to operating out-of-place
This mostly reverts commit 72548b093ee3 except for the copying of
the associated data.
There is no benefit in operating in-place in algif_aead since the
source and destination come from different mappings. Get rid of
all the complexity added for in-place operation and just copy the
AD directly.
Affected
250 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arista | cloudvision_agni | 2024.4.0 – 2025.2.2 | — |
| arista | cloudvision_portal | 2024.2.0 – 2026.1.0 | — |
| arista | netvisor_os | < 7.1.0 | 7.1.0 |
| arista | netvisor_os | — | — |
| arista | netvisor_os | — | — |
| arista | velocloud_edge | 4.5.0 – 6.4.1 | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| github.com | siderolabs_talos | >= 0 < 1.12.7 | 1.12.7 |
| linux | linux | — | — |
| linux | linux | >= 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 < 893d22e0135fa394db81df88697fba6032747667 | 893d22e0135fa394db81df88697fba6032747667 |
| linux | linux | >= 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 < 19d43105a97be0810edbda875f2cd03f30dc130c | 19d43105a97be0810edbda875f2cd03f30dc130c |
| linux | linux | >= 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 < 961cfa271a918ad4ae452420e7c303149002875b | 961cfa271a918ad4ae452420e7c303149002875b |
| linux | linux | >= 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 < 3115af9644c342b356f3f07a4dd1c8905cd9a6fc | 3115af9644c342b356f3f07a4dd1c8905cd9a6fc |
| linux | linux | >= 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 < 8b88d99341f139e23bdeb1027a2a3ae10d341d82 | 8b88d99341f139e23bdeb1027a2a3ae10d341d82 |
| linux | linux | >= 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 < fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8 | fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8 |
| linux | linux | >= 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 < ce42ee423e58dffa5ec03524054c9d8bfd4f6237 | ce42ee423e58dffa5ec03524054c9d8bfd4f6237 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploitation attempts by monitoring for unexpected privilege escalation to UID 0 from low-privilege processes, particularly those using only standard system calls (no unusual syscalls or memory tricks). ↗
- →Monitor integrity of setuid-root binaries (e.g., /usr/bin/su) in the page cache at runtime; unexpected modification without corresponding disk changes is a strong indicator of exploitation. ↗
- →Hunt for Go and Rust implementations of the Copy Fail exploit in open-source repositories and on endpoints, as these variants have already been observed in the wild. ↗
- →The exploit performs a controlled 4-byte overwrite in the kernel page cache — look for anomalous kernel page cache behavior or use of kernel integrity monitoring tools to flag in-memory binary corruption. ↗
- →The PoC is a 732-byte Python script; scan endpoints and CI/CD environments for small Python scripts invoking AF_ALG sockets and splice() as an indicator of exploit staging. ↗
- ·The vulnerability only affects Linux kernels with the algif_aead module loaded; disabling it blocks exploitation but may break applications using the AF_ALG AEAD interface. ↗
- ·The vulnerability is not remotely exploitable in isolation; it requires a local foothold (e.g., SSH access, malicious CI job, or container escape) to be leveraged. ↗
- ·Container environments (Docker, LXC, Kubernetes) are at elevated risk because they grant access to the AF_ALG subsystem by default when algif_aead is loaded on the host kernel, enabling container escape. ↗
- ·Fixed kernel versions are 6.18.22, 6.19.12, and 7.0; some distributions (e.g., Fedora 42+) have updates but no official CVE advisory, so version checks alone may be insufficient to confirm patch status. ↗
- ·The exploit is architecture-aware and targets both AMD64 and AARCH64; detection and mitigation strategies must account for both architectures. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ghsa7.8HIGH
vulncheck7.8HIGH
cisa7.8HIGH
vendor_ubuntu7.8HIGH
vendor_redhat5.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (Xilinx ZynqMP) vulnerabilities
vendor_ubuntu·2026-07-10·CVSS 7.8
CVE-2026-23206 [HIGH] Linux kernel (Xilinx ZynqMP) vulnerabilities
Title: Linux kernel (Xilinx ZynqMP) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the
RxRPC networking subsystem when processing paged fragments. A local
attacker could use this to escalate privileges, or possibly escape a
container. (CVE-2026-43284, CVE-2026-43500)
It was discovered that a
Ubuntu
Linux kernel (Xilinx) vulnerabilities
vendor_ubuntu·2026-07-02·CVSS 7.8
CVE-2026-43314 [HIGH] Linux kernel (Xilinx) vulnerabilities
Title: Linux kernel (Xilinx) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the
RxRPC networking subsystem when processing paged fragments. A local
attacker could use this to escalate privileges, or possibly escape a
container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000)
Ubuntu
Linux kernel (Oracle) vulnerabilities
vendor_ubuntu·2026-06-22·CVSS 7.8
CVE-2026-43284 [HIGH] Linux kernel (Oracle) vulnerabilities
Title: Linux kernel (Oracle) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the
RxRPC networking subsystem when processing paged fragments. A local
attacker could use this to escalate privileges, or possibly escape a
container. (CVE-2026-43284, CVE-2026-43500)
It was discovered that a logic f
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-06-17·CVSS 7.8
CVE-2026-43033 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- Packet sockets;
(CVE-2026-31504, CVE-2026-43033, CVE-2026-43077, CVE-2026-43078,
CVE-2026-46028)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unav
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-06-16·CVSS 7.8
CVE-2026-43503 [HIGH] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the
RxRPC networking subsystem when processing paged fragments. A local
attacker could use this to escalate privileges, or possibly escape a
container. (CVE-2026-43284, CVE-2026-43500)
It was discovered that a logic fl
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-06-16·CVSS 6.4
CVE-2026-23262 [MEDIUM] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo
Rizzo discovered that some AMD Zen processors did not properly verify the
signature of CPU microcode. This flaw is known as EntrySign. A privileged
attacker could possibly use this issue to cause load malicious CPU
microcode causing loss of integrity and confidentiality. (CVE-2024-36347)
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
It was discovered that the Linux kernel did not properly handle share
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-06-11·CVSS 7.8
CVE-2026-46333 [HIGH] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the
RxRPC networking subsystem when processing paged fragments. A local
attacker could use this to escalate privileges, or possibly escape a
container. (CVE-2026-43284, CVE-2026-43500)
It was discovered that a logic fl
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-06-04·CVSS 7.8
CVE-2026-43033 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the
RxRPC networking subsystem when processing paged fragments. A local
attacker could use this to escalate privileges, or possibly escape a
container. (CVE-2026-43284, CVE-2026-43500)
Several security issues were discovered i
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities
vendor_ubuntu·2026-06-04·CVSS 7.8
CVE-2026-23069 [HIGH] Linux kernel (Azure FIPS) vulnerabilities
Title: Linux kernel (Azure FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the
RxRPC networking subsystem when processing paged fragments. A local
attacker could use this to escalate privileges, or possibly escape a
container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-4600
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-06-04·CVSS 5.5
CVE-2026-31504 [MEDIUM] Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the
RxRPC networking subsystem when processing paged fragments. A local
attacker could use this to escalate privileges, or possibly escape a
container. (CVE-2026-43284, CVE-2026-43500)
Several security issues w
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-06-02·CVSS 7.8
CVE-2025-71134 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the
RxRPC networking subsystem when processing paged fragments. A local
attacker could use this to escalate privileges, or possibly escape a
container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000)
It was di
Ubuntu
Kernel Live Patch Security Notice
vendor_ubuntu·2026-06-01·CVSS 7.8
CVE-2026-31431 [HIGH] Kernel Live Patch Security Notice
Title: Kernel Live Patch Security Notice
Summary: Several security issues were fixed in the kernel.
In the Linux kernel, the following vulnerability has been
resolved: KVM: arm64: Tear down vGIC on failed vCPU creation If
kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor, we
propagate the error back to the ioctl but leave the vGIC vCPU data
initialised.
In the Linux kernel, the following vulnerability has been
resolved: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU length
or offset exceeds sg_cnt and then use bogus sg->length/offset values,
leading to _copy_to_iter() GPF/KASAN.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic opera
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities
vendor_ubuntu·2026-06-01·CVSS 7.8
CVE-2026-31533 [HIGH] Linux kernel (NVIDIA Tegra) vulnerabilities
Title: Linux kernel (NVIDIA Tegra) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- Ethernet bonding driver;
- Packet sockets;
- TLS protocol;
(CVE-2026-31419, CVE-2026-31504, CVE-2026-31533, CVE-2026-43033,
CVE-2026-43077, CVE-2026-43078, CVE-2026-46028)
Instructions: After a standard system update you n
Ubuntu
Linux kernel (Low Latency) vulnerabilities
vendor_ubuntu·2026-06-01·CVSS 7.8
CVE-2026-31533 [HIGH] Linux kernel (Low Latency) vulnerabilities
Title: Linux kernel (Low Latency) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- Ethernet bonding driver;
- Packet sockets;
- TLS protocol;
(CVE-2026-31419, CVE-2026-31504, CVE-2026-31533, CVE-2026-43033,
CVE-2026-43077, CVE-2026-43078, CVE-2026-46028)
Instructions: After a standard system update you ne
Ubuntu
Linux kernel (Low Latency) vulnerabilities
vendor_ubuntu·2026-05-26·CVSS 7.8
CVE-2026-31419 [HIGH] Linux kernel (Low Latency) vulnerabilities
Title: Linux kernel (Low Latency) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- Ethernet bonding driver;
- Packet sockets;
- TLS protocol;
(CVE-2026-31419, CVE-2026-31504, CVE-2026-31533, CVE-2026-43033,
CVE-2026-43077, CVE-2026-43078)
Instructions: After a standard system update you need to reboot you
Ubuntu
Linux kernel (IoT) vulnerabilities
vendor_ubuntu·2026-05-26·CVSS 7.8
CVE-2026-31533 [HIGH] Linux kernel (IoT) vulnerabilities
Title: Linux kernel (IoT) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- Packet sockets;
- TLS protocol;
(CVE-2026-31504, CVE-2026-31533, CVE-2026-43033, CVE-2026-43077,
CVE-2026-43078)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTE
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-05-26·CVSS 7.8
CVE-2026-23168 [HIGH] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Cryptographic API;
- Compute Acceleration Framework;
- Drivers core;
- Null block device driver;
- Ublk userspace block driver;
- Bluetooth drivers;
- Counter interface drivers;
- DMA engine subsystem;
- DPLL
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-05-26·CVSS 5.5
CVE-2026-23274 [MEDIUM] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- S390 architecture;
- Cryptographic API;
- GPU drivers;
- Ethernet bonding driver;
- Microsoft Azure Network Adapter (MANA) driver;
- Network file system (NFS) server daemon;
- Distributed Switch Architecture;
- Netfilter;
- Control group (cgroup);
- K
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-05-25·CVSS 7.8
CVE-2026-23168 [HIGH] Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Cryptographic API;
- Compute Acceleration Framework;
- Drivers core;
- Null block device driver;
- Ublk userspace block driver;
- Bluetooth drivers;
- Counter interface drivers;
- DMA engine subsystem;
- DPLL
Ubuntu
Linux kernel (Intel IoTG Real-time) vulnerabilities
vendor_ubuntu·2026-05-25·CVSS 7.8
CVE-2026-31533 [HIGH] Linux kernel (Intel IoTG Real-time) vulnerabilities
Title: Linux kernel (Intel IoTG Real-time) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- Ethernet bonding driver;
- Packet sockets;
- TLS protocol;
(CVE-2026-31419, CVE-2026-31504, CVE-2026-31533, CVE-2026-43033,
CVE-2026-43077, CVE-2026-43078)
Instructions: After a standard system update you need to r
Ubuntu
Linux kernel (NVIDIA Tegra IGX) vulnerabilities
vendor_ubuntu·2026-05-25·CVSS 7.8
CVE-2024-35862 [HIGH] Linux kernel (NVIDIA Tegra IGX) vulnerabilities
Title: Linux kernel (NVIDIA Tegra IGX) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- Ethernet bonding driver;
- SMB network file system;
- Netfilter;
- io_uring subsystem;
- Packet sockets;
- TLS protocol;
(CVE-2024-35862, CVE-2024-50060, CVE-2026-23274, CVE-2026-23351,
CVE-2026-31419, CVE-2026-31504, C
Ubuntu
Linux kernel (Azure)vulnerabilities
vendor_ubuntu·2026-05-22·CVSS 7.8
CVE-2026-31504 [HIGH] Linux kernel (Azure)vulnerabilities
Title: Linux kernel (Azure)vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- Packet sockets;
- TLS protocol;
(CVE-2026-31504, CVE-2026-31533, CVE-2026-43033, CVE-2026-43077,
CVE-2026-43078)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATT
Ubuntu
Linux kernel (Oracle) vulnerabilities
vendor_ubuntu·2026-05-22·CVSS 5.5
CVE-2026-23274 [MEDIUM] Linux kernel (Oracle) vulnerabilities
Title: Linux kernel (Oracle) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- S390 architecture;
- Cryptographic API;
- GPU drivers;
- Ethernet bonding driver;
- Network file system (NFS) server daemon;
- Distributed Switch Architecture;
- Netfilter;
- Control group (cgroup);
- Kernel kexec() syscall;
- Memory management;
- MA
Ubuntu
Linux kernel (GCP) vulnerabilities
vendor_ubuntu·2026-05-22·CVSS 7.8
CVE-2026-23274 [HIGH] Linux kernel (GCP) vulnerabilities
Title: Linux kernel (GCP) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- Ethernet bonding driver;
- SMB network file system;
- Netfilter;
- io_uring subsystem;
- Packet sockets;
- TLS protocol;
(CVE-2024-35862, CVE-2024-50060, CVE-2026-23274, CVE-2026-23351,
CVE-2026-31419, CVE-2026-31504, CVE-2026-31533
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-05-22·CVSS 7.8
CVE-2026-31504 [HIGH] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- Packet sockets;
(CVE-2026-31504, CVE-2026-43033, CVE-2026-43077, CVE-2026-43078)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable A
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-05-20·CVSS 7.8
CVE-2025-71268 [HIGH] Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Cryptographic API;
- Compute Acceleration Framework;
- Drivers core;
- Null block device driver;
- Ublk userspace block driver;
- Bluetooth drivers;
- Counter interface drivers;
- DMA engine subsystem;
- DPLL
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-05-19·CVSS 7.8
CVE-2026-31533 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- Packet sockets;
- TLS protocol;
(CVE-2026-31504, CVE-2026-31533, CVE-2026-43033, CVE-2026-43077,
CVE-2026-43078)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION:
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-05-19·CVSS 7.8
CVE-2026-43077 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- Ethernet bonding driver;
- SMB network file system;
- Netfilter;
- io_uring subsystem;
- Packet sockets;
- TLS protocol;
(CVE-2024-35862, CVE-2024-50060, CVE-2026-23274, CVE-2026-23351,
CVE-2026-31419, CVE-2026-31504, CVE-2026-31533, CVE-
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-05-19·CVSS 7.8
CVE-2025-71268 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Cryptographic API;
- Compute Acceleration Framework;
- Drivers core;
- Null block device driver;
- Ublk userspace block driver;
- Bluetooth drivers;
- Counter interface drivers;
- DMA engine subsystem;
- DPLL subsyste
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-05-19·CVSS 7.8
CVE-2026-43078 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- Packet sockets;
(CVE-2026-31504, CVE-2026-43033, CVE-2026-43077, CVE-2026-43078)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI chang
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-05-19·CVSS 5.5
CVE-2026-43078 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- S390 architecture;
- Cryptographic API;
- GPU drivers;
- Ethernet bonding driver;
- Network file system (NFS) server daemon;
- Distributed Switch Architecture;
- Netfilter;
- Control group (cgroup);
- Kernel kexec() syscall;
- Memory management;
- MAC80211 su
CISA
Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
cisa·2026-05-01·CVSS 7.8
CVE-2026-31431 [HIGH] CWE-699 Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
Vulnerability: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
Affected: Linux Kernel
Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.
Required Action: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/; https://xint.io/blog/copy-fail-linux-distributions#the-fix-6 ; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/about/ ; https://nvd.nist.gov/vuln/detail/CVE-2026-31431
Remediation Due Date: 2026-05-15
Ubuntu
kmod update
vendor_ubuntu·2026-04-30
CVE-2026-31431 kmod update
Title: kmod update
Summary: kmod has been updated to block loading of the algif_aead kernel module.
USN-8226-1 added a mitigation to kmod to disable loading the algif_aead
module. This update adds the same mitigation to Ubuntu 14.04 LTS,
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that the Linux kernel algif_aead module contained a logic
flaw allowing a local attacker to escalate privileges to root. This update
to the kmod package disables loading the algif_aead module as a measure to
mitigate the issue until kernel updates are made available.
See the following URL for more information
https://ubuntu.com/blog/copy-fail-vulnerability-fixes-available
Instructions: After a standard system update you need to reboot your computer
Ubuntu
kmod update
vendor_ubuntu·2026-04-30
CVE-2026-31431 kmod update
Title: kmod update
Summary: kmod has been updated to block loading of the algif_aead kernel module.
It was discovered that the Linux kernel algif_aead module contained a logic
flaw allowing a local attacker to escalate privileges to root. This update
to the kmod package disables loading the algif_aead module as a measure to
mitigate the issue until kernel updates are made available.
See the following URL for more information
https://ubuntu.com/blog/copy-fail-vulnerability-fixes-available
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Red Hat
kernel: crypto: algif_aead - Revert to operating out-of-place
vendor_redhat·2026-04-22·CVSS 5.5
CVE-2026-31431 [MEDIUM] CWE-1288 kernel: crypto: algif_aead - Revert to operating out-of-place
kernel: crypto: algif_aead - Revert to operating out-of-place
A flaw was found in the Linux kernel's algif_aead cryptographic algorithm interface. An incorrect 'in-place operation' was introduced, where the source and destination data mappings were different. This could lead to unexpected behavior or data integrity issues during cryptographic operations, potentially impacting the reliability of encrypted communications.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Fix deferred
Package: kernel-rt (Red Hat Enterprise Linux 8) - Fix deferred
P
Fortinet
Linux Kernel Vulnerability copy.fail - CVE-2026-31431
vendor_fortinet·CVSS 7.8
CVE-2026-31431 [HIGH] Linux Kernel Vulnerability copy.fail - CVE-2026-31431
FG-IR-26-139: Linux Kernel Vulnerability copy.fail - CVE-2026-31431
CVSSv3 Score:
7.8
CVE-2026-31431In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
Revised on 2026-05-13 00:00:00
GHSA
Talos Linux has a local privilege escalation from untrusted workloads
ghsa·2026-05-07·CVSS 7.8
CVE-2026-31431 [HIGH] CWE-669 Talos Linux has a local privilege escalation from untrusted workloads
Talos Linux has a local privilege escalation from untrusted workloads
### Summary
A vulnerability in the Linux kernel's algif_aead subsystem (CVE-2026-31431, "copy.fail") allows an unprivileged container workload to corrupt arbitrary file page-cache pages via the AF_ALG crypto interface and splice(). On Talos Linux, this vulnerability can be chained into a complete node compromise: an attacker who can schedule a pod on a worker node can, without any elevated Kubernetes permissions, achieve arbitrary code execution as root on the host (by poisoning a binary inside a privileged pod, or poisoning a binary which runs with elevated privileges like a CNI binary), access host filesystem, including node secrets.
The exploit does not require kernel debugging, race conditions, or any prior privil
GHSA
GHSA-2274-3hgr-wxv6: In the Linux kernel, the following vulnerability has been resolved:
crypto: algif_aead - Revert to operating out-of-place
This mostly reverts commit
ghsa_unreviewed·2026-04-22
CVE-2026-31431 GHSA-2274-3hgr-wxv6: In the Linux kernel, the following vulnerability has been resolved:
crypto: algif_aead - Revert to operating out-of-place
This mostly reverts commit
In the Linux kernel, the following vulnerability has been resolved:
crypto: algif_aead - Revert to operating out-of-place
This mostly reverts commit 72548b093ee3 except for the copying of
the associated data.
There is no benefit in operating in-place in algif_aead since the
source and destination come from different mappings. Get rid of
all the complexity added for in-place operation and just copy the
AD directly.
VulnCheck
Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
vulncheck·2026·CVSS 7.8
CVE-2026-31431 [HIGH] CWE-699 Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.
Affected: Linux Kernel
Required Action: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Exploit PoC: https://vulncheck.com/xdb/f258994f2af7; https://vulncheck.com/xdb/8d7730781617; https://vulncheck.com/xdb/e705019c9e13; https://vulncheck.com/xdb/8a1dc931a413; https://vulncheck.com/xdb/32f668d95a3c
Remediation Due: 2026-05-15
Exploit-DB
Linux Kernel 6.8 - Local Privilege Escalation
exploitdb·2026-05-26
CVE-2026-31431 Linux Kernel 6.8 - Local Privilege Escalation
Linux Kernel 6.8 - Local Privilege Escalation
---
* Exploit Title: Linux Kernel 5.4 - 6.8 - Local Privilege Escalation
* Google Dork: N/A
* Date: 2026-04-30
* Exploit Author: Long Fong Chan (https://github.com/iss4cf0ng)
* Vendor Homepage: https://www.kernel.org/
* Software Link: https://git.kernel.org/
* Version: Linux Kernel 5.4 - 6.8 (unpatched)
* Tested on: Ubuntu 22.04, Debian 12
*
* Description:
* Linux kernel AF_ALG (algif_aead) vulnerability allows local users
* to perform arbitrary file overwrite in page cache via splice()
* and AEAD crypto interface, leading to privilege escalation.
*
* This exploit overwrites /usr/bin/su in memory and spawns a root shell.
*
* Requirements:
* - Unprivileged local user
* - algif_aead module loaded
*
* Usage:
* --test Check vulnerability
* --expl
Metasploit
Copy Fail AF_ALG + authencesn Page-Cache Write
metasploit
CVE-2026-31431 Copy Fail AF_ALG + authencesn Page-Cache Write
Copy Fail AF_ALG + authencesn Page-Cache Write
CVE-2026-31431 is a logic flaw in the Linux kernel's authencesn AEAD template that, when reached via the AF_ALG socket interface combined with splice(), allows an unprivileged local user to perform a controlled 4-byte write into the page cache of any readable file. Because the corrupted pages are never marked dirty, the on-disk file is unchanged but the in-memory version is immediately visible system-wide, enabling local privilege escalation by injecting shellcode into the page cache of a setuid-root binary such as /usr/bin/su. The vulnerability was introduced by an in-place optimization in algif_aead.c (commit 72548b093ee3, 2017) and affects essentially all major Linux distributions shipped since then until the fix in commit a664bf3d603d.
Nuclei
Copy Fail - Linux Kernel Local Privilege Escalation via AF_ALG
nuclei·CVSS 7.8
CVE-2026-31431 [HIGH] Copy Fail - Linux Kernel Local Privilege Escalation via AF_ALG
Copy Fail - Linux Kernel Local Privilege Escalation via AF_ALG
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
Template:
id: CVE-2026-31431
info:
name: Copy Fail - Linux Kernel Local Privilege Escalation via AF_ALG
author: ritikchaddha
severity: high
description: |
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee
Hackernews
Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry
blogs_hackernews·2026-07-24
CVE-2026-31431 Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry
Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand's Ministry of Finance, which runs the country's treasury and tax collection.
The agent then worked through the ministry's network on its own, checking hosts for ways to gain root access, hunting through file systems, and crawling a folder of staff personnel records going back to 2012.
The operator left the agent's own logs sitting on a web server with directory listing
Unit42
Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy
blogs_unit42·2026-07-17·CVSS 7.5
CVE-2025-40947 [HIGH] Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy
## Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy
Emmanuel Zhou
Adam Robbie
Rick Wyble
Miguel Pereira
Published: July 17, 2026
Threat Research
Vulnerabilities
Command injection
CVE-2025-40947
CVE-2025-40948
CVE-2025-40949
Exploit Chain
Privilege escalation
Rox II OT switches
## Executive Summary
We conducted this research in close partnership with Siemens, reflecting our shared commitment to advancing the security and resilience of critical infrastructure.
This report details a critical, chained exploit comprising three zero-day vulnerabilities (CVE-2025-40948, CVE-2025-40947, and CVE-2025-40949) discovered in Siemens ROX II operational technology (OT) switches. Successful exploitation of this chain would allow an attacker to achieve full privilege escal
Hackernews
15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros
blogs_hackernews·2026-07-08·CVSS 7.8
CVE-2026-43499 [HIGH] 15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## 15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros
Researchers at Nebula Security have disclosed GhostLock ( CVE-2026-43499 ), a 15-year-old Linux kernel flaw that lets any logged-in user take full root control of a machine that has not been patched.
The vulnerable code has shipped by default in essentially every mainstream distribution since 2011. The flaw needs no special permission, no unusual settings, and no network access; ordinary threading calls from any local program are enough.
Nebula turned it into a working root exploit that is 97% reliable in its testing and also escapes containe
Hackernews
New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android
blogs_hackernews·2026-07-04·CVSS 7.8
CVE-2026-46242 [HIGH] New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android
A newly disclosed Linux kernel flaw called Bad Epoll (CVE-2026-46242) lets an ordinary user with no special access take full control of a machine as root. It affects Linux desktops, servers, and Android, and a fix is out.
Bad Epoll sits in the same small stretch of kernel code where Anthropic's most powerful AI model, Mythos , recently found a different bug.
The AI caught one flaw and missed this one. A researcher, Jaeyoung Chung, found it and built a working attack.
## How the Bug Works
Epoll is a standard Linux feature that lets a progra
Hackernews
New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets
blogs_hackernews·2026-06-26·CVSS 8.8
CVE-2026-43503 [HIGH] New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets
DirtyClone is a new Linux kernel privilege escalation in the DirtyFrag family. JFrog Security Research published a working exploit walkthrough for the flaw on June 25, the first public demonstration for this variant.
Tracked as CVE-2026-43503 (CVSS 8.8), it lets a local user corrupt file-backed memory through a cloned network packet and gain root. The patch landed in mainline on May 21; if your kernel does not have it, update now.
When the kernel copies a network packet internally, two helper functions drop a safety flag that marks the packet's m
Hackernews
Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models
blogs_hackernews·2026-06-09
CVE-2026-39987 Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models
University of Toronto researchers have built and tested a proof-of-concept AI-driven computer worm that uses a locally hosted open-weight large language model to reason its way through a network, generate tailored attack strategies for each target it encounters, and replicate itself, all without human intervention and without touching a commercial AI service.
The preprint, posted to arXiv on June 2 and currently under peer review, shows why single-CVE patching breaks down when malware can inspect exposed services, read fresh adviso
Unit42
Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257
blogs_unit42·2026-06-05·CVSS 7.8
CVE-2026-0257 [HIGH] Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257
## Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257
Andy Piazza
Unit 42
Published: June 5, 2026
High Profile Threats
Vulnerabilities
CVE-2026-0257
Vulnerability
Palo Alto Networks Unit 42 has observed active exploitation of PAN-OS vulnerability CVE-2026-0257 by an unidentified threat actor attempting to access GlobalProtect. This security flaw involves an authentication bypass in the portal and gateway components of vulnerable versions of PAN-OS ® software, which could allow unauthorized attackers to circumvent security controls and initiate VPN connections. This CVE was added to the Known Exploited Vulnerability (KEV) catalog on May 29.
No post-access behavior or lateral movement has been identified as of this time. Only a small portion of the probed devices actually es
Rapid7
Metasploit Wrap Up 05/22/2026
blogs_rapid7·2026-05-22·CVSS 9.8
CVE-2026-20182 [CRITICAL] Metasploit Wrap Up 05/22/2026
## Another week, another authentication bypass
Our humble Metasploit weekly(ish) blog has been blessed with a new network component vulnerability. The dynamic duo of @sfewer-r7 and @jburgess-r7 have discovered and authored the admin/networking/cisco_sdwan_vhub_auth_bypass module for CVE-2026-20182, a vulnerability gracing the Cisco Catalyst SD-WAN Controller. The devices, whose purpose is to control a software-defined (SD) wide-area-network (WAN) was unfortunately missing an extra A for authentication. An oversight that Cisco has duly patched.
Elsewhere this week, the HUSTOJ online judge platform has been caught failing to judge its own zip files (CVE-2026-24479), courtesy of a zip-slip RCE module from LoTuS and friends. Next, @Alpenlol has weaponized the small matter of Barracuda's Emai
Hackernews
DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability
blogs_hackernews·2026-05-19·CVSS 7.5
CVE-2026-31635 [HIGH] DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability
Proof-of-concept (PoC) exploit code has now been released for a recently patched security flaw in the Linux kernel that could allow for local privilege escalation (LPE).
Dubbed DirtyDecrypt (aka DirtyCBC), the vulnerability was discovered and reported by the Zellic and V12 security team on May 9, 2026, only to be informed by the maintainers that it was a duplicate of a vulnerability that had already been patched in the mainline.
"It's a rxgk pagecache write due to missing COW [copy-on-write] guard in rxgk_decrypt_skb," Zellic co-founder Luna Tong (a
Huntress
Panic at the Distro
blogs_huntress·2026-05-14·CVSS 7.8
CVE-2026-31431 [HIGH] Panic at the Distro
Acknowledgments: Special thanks to Jamie Levy, Tom Lawrence, Jim Deville, Tyler Bohlmann, and Shivangi Pandey for their contributions to this write-up.
## TL;DR
It’s never a good day for administrators when a branded vulnerability drops, especially when multiple of them land in rapid fire. Over the last two weeks, security researchers independently discovered multiple vulnerabilities in the Linux kernel that allow an unprivileged user to easily gain root access (local privilege escalation). All of these named vulnerabilities pertain to the Linux kernel’s zero-copy functionality, and are named CopyFail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 and CVE-2026-43500), and Fragnesia (CVE-2026-46300).
While these vulnerabilities require an attacker to have established access on a victim mac
Tenable
Fragnesia (CVE-2026-46300): Frequently asked questions about new Linux Kernel XFRM ESP-in-TCP privilege escalation
blogs_tenable·2026-05-14
CVE-2026-46300 Fragnesia (CVE-2026-46300): Frequently asked questions about new Linux Kernel XFRM ESP-in-TCP privilege escalation
## Exposure Management
## Explore By Use Case
## Explore By Industry
## Tenable is the one clear leader in Exposure Management
## Exposure management
resource center
## Accelerate your exposure management strategy with practical resources and tools.
## Explore By Use Case
## Explore By Industry
## Tenable is the one clear leader in Exposure Management
## Exposure management
resource center
## Accelerate your exposure management strategy with practical resources and tools.
## Fragnesia (CVE-2026-46300): Frequently asked questions about new Linux Kernel XFRM ESP-in-TCP privilege escalation
A new Linux kernel local privilege escalation exploit with a public proof-of-concept targets the same subsystem as Dirty Frag but requires a separate patch.
## Key Takeaways
CVE
Qualys
Dirty Frag: Using the Page Caches as an Attack Surface
blogs_qualys·2026-05-09·CVSS 7.8
CVE-2026-43284 [HIGH] Dirty Frag: Using the Page Caches as an Attack Surface
## Table of Contents
Qualys QID Coverage
Remediate at Scale With TruRiskEliminate
Dirty Frag is a Linux local privilege escalation (LPE) chain published on May 7, 2026. It combines two previously unknown kernel vulnerabilities can allow an unprivileged local user to escalate to root on many major Linux distributions.
xfrm-ESP Page-Cache Write (CVE-2026-43284)
RxRPC Page-Cache Write (CVE-2026-43500)
As of May 8, 2026, CVE-2026-43284 had been patched in mainline Linux, while public reporting indicated that CVE-2026-43500 did not yet have patches available.
The Dirty Pipe Connection:
Dirty Frag is the third discovery of a bug class that all share similar logic. A zero-copy send path plants an attacker-controlled or attacker-readable page into a kernel data structure as a raw reference
Wiz
Dirty Frag: Linux Kernel Local Privilege Escalation via ESP and RxRPC
blogs_wiz·2026-05-08·CVSS 7.8
CVE-2026-43284 [HIGH] Dirty Frag: Linux Kernel Local Privilege Escalation via ESP and RxRPC
A newly disclosed Linux kernel local privilege escalation vulnerability chain, dubbed “Dirty Frag” and assigned CVE-2026-43284 and CVE-2026-43500 , enables attackers with local access to obtain root privileges by exploiting flaws in the ESP (IPsec) and RxRPC subsystems. While no official patches are currently available, a public proof-of-concept exists. Organizations should assume the vulnerability is valid and exploitable under certain conditions. This vulnerability is a successor to Copy Fail (CVE-2026-31431) , and was discovered by Hyunwoo Kim (@v4bel). "CopyFail2" is another name for the same vulnerability, and is based on an exploit reversed from the fix commit .
## What is Dirty Frag?
Dirty Frag is a vulnerability chain combining two page-cache write primitives in the Linux kernel:
Sans Isc
Another Universal Linux Local Privilege Escalation (LPE) Vulnerability: Dirty Frag, (Fri, May 8th)
blogs_sans_isc·2026-05-08·CVSS 7.8
CVE-2026-31431 [HIGH] Another Universal Linux Local Privilege Escalation (LPE) Vulnerability: Dirty Frag, (Fri, May 8th)
Another Universal Linux Local Privilege Escalation (LPE) Vulnerability: Dirty Frag
Published: 2026-05-08. Last Updated: 2026-05-08 14:57:03 UTC
by Yee Ching Tok (Version: 1)
0 comment(s)
Less than two weeks after the public disclosure of the Copy Fail vulnerability (CVE-2026-31431), another local privilege escalation (LPE) vulnerability in the Linux kernel has been revealed. Referred to as "Dirty Frag," this vulnerability was discovered and reported by Hyunwoo Kim (@v4bel) [1]. In this diary, I will provide a brief background on Dirty Frag, and discuss its relationship to Copy Fail. I will then discuss how to mitigate Dirty Frag and outline recommended next steps for system owners.
The existence of Dirty Frag was revealed after the coordinated disclosure embargo was broken by an unrela
Hackernews
Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions
blogs_hackernews·2026-05-08·CVSS 7.8
CVE-2026-31431 [HIGH] Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions
Details have emerged about a new, unpatched local privilege escalation (LPE) vulnerability impacting the Linux kernel.
Dubbed Dirty Frag , it has been described as a successor to Copy Fail (CVE-2026-31431, CVSS score: 7.8), a recently disclosed LPE flaw impacting the Linux kernel that has since come under active exploitation in the wild. The vulnerability was reported to Linux kernel maintainers on April 30, 2026.
"Dirty Frag is a vulnerability (class) that achieves root privileges on most Linux distributions by chaining the xfrm-ESP Page-Cac
Tenable
Dirty Frag (CVE-2026-43284, CVE-2026-43500): Frequently asked questions about this Linux kernel privilege escalation vulnerability chain
blogs_tenable·2026-05-08·CVSS 7.8
CVE-2026-43284 [HIGH] Dirty Frag (CVE-2026-43284, CVE-2026-43500): Frequently asked questions about this Linux kernel privilege escalation vulnerability chain
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Unit42
Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution
blogs_unit42·2026-05-07·CVSS 9.3
CVE-2026-0300 [CRITICAL] Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution
## Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution
Justin Moore
Unit 42
Published: May 6, 2026
High Profile Threats
Vulnerabilities
CVE-2026-0300
EarthWorm
PAN-OS
Remote Code Execution
ReverseSocks5
Vulnerability
Zero-day
## Executive Summary
On May 6, 2026, Palo Alto Networks released a security advisory for CVE-2026-0300 , identifying a buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software. Vulnerable systems allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.
We are aware of only limited exploitation of CVE-2026-0300 at this time
Unit42
Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years
blogs_unit42·2026-05-05·CVSS 7.8
CVE-2026-31431 [HIGH] Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years
## Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years
Justin Moore
Published: May 5, 2026
High Profile Threats
Vulnerabilities
Containers
CVE-2026-31431
Kubernetes
Linux
Local privilege escalation
Page cache
Vulnerability
## Executive Summary
On April 29, 2026, researchers publicly disclosed a highly reliable local privilege escalation (LPE) vulnerability tracked as CVE-2026-31431 . This vulnerability is commonly referred to as Copy Fail. Discovered in about an hour through an AI-assisted process , this logic flaw allows an unprivileged local attacker to consistently escalate their access to root across virtually all major Linux distributions released since 2017.
Unlike many kernel vulnerabilities, this logic flaw is deterministic, meaning it does
Bleepingcomputer
CISA says ‘Copy Fail’ flaw now exploited to root Linux systems
blogs_bleepingcomputer·2026-05-04·CVSS 7.8
CVE-2026-31431 [HIGH] CISA says ‘Copy Fail’ flaw now exploited to root Linux systems
## CISA says ‘Copy Fail’ flaw now exploited to root Linux systems
## Sergiu Gatlan
On Friday, CISA added the Copy Fail security flaw to its Known Exploited Vulnerabilities (KEV) Catalog , ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Linux endpoints and servers within two weeks, by May 15, as mandated by Binding Operational Directive (BOD) 22-01 .
"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," the U.S. cybersecurity agency warned.
"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
While BOD 22-01 applies only to U.S. government agencies, CISA urged all
Hackernews
⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE & More
blogs_hackernews·2026-05-04·CVSS 9.3
CVE-2026-41940 [CRITICAL] ⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE & More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE & More
This week, the shadows moved faster than the patches.
While most teams were still triaging last month’s alerts, attackers had already turned control panels into kill switches, kernels into open doors, and open-source pipelines into silent delivery systems.
The game has shifted from breach to occupation. They’re living inside SaaS sessions, pushing code with trusted commits, and scaling operations like legitimate businesses — except their product is chaos. And the underground is getting uncomfortably professional.
Here’s the full week
Sans Isc
TeamPCP Weekly Analysis: 2026-W18 (2026-04-27 through 2026-05-03), (Mon, May 4th)
blogs_sans_isc·2026-05-04
CVE-2024-1708 TeamPCP Weekly Analysis: 2026-W18 (2026-04-27 through 2026-05-03), (Mon, May 4th)
TeamPCP Weekly Analysis: 2026-W18 (2026-04-27 through 2026-05-03)
Published: 2026-05-04. Last Updated: 2026-05-04 17:12:18 UTC
by Kenneth Hartman (Version: 1)
0 comment(s)
Summary
The most significant development of the week was the April 29 to 30 Mini Shai-Hulud worm, a self-propagating supply chain campaign that compromised four official SAP npm packages, two PyTorch Lightning PyPI versions, two intercom-client npm versions, and the intercom-php Packagist package across three package ecosystems. OX Security tracked roughly 1,800 GitHub repositories created with stolen credentials by the worm during the two day campaign, and Wiz attributed the operation to TeamPCP at high confidence based on a shared RSA public key with the prior Bitwarden CLI and Checkmarx KICS operations. Reporting s
Hackernews
CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV
blogs_hackernews·2026-05-03·CVSS 7.8
CVE-2026-31431 [HIGH] CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a recently disclosed security flaw impacting various Linux distributions to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation in the wild.
The vulnerability, tracked as CVE-2026-31431 (CVSS score: 7.8), is a case of local privilege escalation (LPE) flaw that could allow an unprivileged local user to obtain root. The nine-year-old flaw is also tracked as Copy Fail by Theori and Xint. Fixes have been made available in Linux kernel ver
Rapid7
Metasploit Wrap-Up 05/01/2026
blogs_rapid7·2026-05-01·CVSS 7.8
CVE-2026-31431 [HIGH] Metasploit Wrap-Up 05/01/2026
## MCP server
This release our very own cdelafuente-r7 finished implementing the Metasploit MCP Server (msfmcpd), bringing Model Context Protocol support to Metasploit Framework. MCP lets AI applications like Claude, Cursor, or your own custom agents query Metasploit data. Think of it as a middleware layer that exposes 8 standardized tools for searching modules and pulling reconnaissance data, all built on the official Ruby MCP SDK .
This first iteration is read-only, covering modules, hosts, services, vulnerabilities, and more. Tools for module execution, session interaction, and database modifications are on the roadmap for a future release. Full details are available in the documentation .
## Copy Fail
Earlier this week, details of a new and high profile Linux LPE were released alon
Wiz
Copy Fail: Universal Linux Local Privilege Escalation Vulnerability
blogs_wiz·2026-05-01·CVSS 7.8
CVE-2026-31431 [HIGH] Copy Fail: Universal Linux Local Privilege Escalation Vulnerability
CVE-2026-31431 (dubbed "Copy Fail") is an easily exploitable vulnerability in the Linux kernel that allows escalation from an unprivileged local user account to root access. The vulnerability was discovered by Xint, and affects nearly all versions of the Linux kernel since 2017. While a fix is available upstream, many Linux distributions have not yet released patches as of May 1st.
## What is CVE-2026-31431?
As described by Xint, “an unprivileged local user can write 4 controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root.”
algif_aead
AF_ALG
splice()
setuid
/usr/bin/su
Beyond local privilege escalation, the vulnerability also allows for container escape in certain scenarios. For example, if an attacker gains access to an unprivileged
Bleepingcomputer
New Linux ‘Copy Fail’ flaw gives hackers root on major distros
blogs_bleepingcomputer·2026-04-30
CVE-2026-31431 New Linux ‘Copy Fail’ flaw gives hackers root on major distros
## New Linux ‘Copy Fail’ flaw gives hackers root on major distros
## Bill Toulas
## Copy Fail root cause
In a detailed write-up , the researchers say that the Copy Fail (CVE-2026-31431) issue "is a logic bug in the Linux kernel's authencesn cryptographic template" that allows an authenticated user to reliably perform a "4-byte write in to the page cache of any readable file on the system."
By combining the ‘AF_ALG’ socket-based interface, which gives access to the Linux kernel crypto functions from user space, and the splice() system call, an unprivileged user can make a 4-byte controlled write in the page cache of a file, instead of a normal buffer.
If those 4 bytes hit a setuid-root binary, they can alter its behavior when executed, giving the attacker root privileges.
The flaw was
Tenable
Copy Fail (CVE-2026-31431): Frequently asked questions about Linux kernel privilege escalation vulnerability
blogs_tenable·2026-04-30
CVE-2026-31431 Copy Fail (CVE-2026-31431): Frequently asked questions about Linux kernel privilege escalation vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Hackernews
New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions
blogs_hackernews·2026-04-30·CVSS 7.8
CVE-2026-31431 [HIGH] New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions
Cybersecurity researchers have disclosed details of a Linux local privilege escalation (LPE) flaw that could allow an unprivileged local user to obtain root.
The high-severity vulnerability tracked as CVE-2026-31431 (CVSS score: 7.8) has been codenamed Copy Fail by Xint.io and Theori.
"An unprivileged local user can write four controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root," the vulnerability research team at Xint.io and Theori said .
At its core, the vulnerability stems from a logic flaw i
Bugzilla
CVE-2026-31431 kernel: crypto: algif_aead - Revert to operating out-of-place
bugzilla·2026-04-22
CVE-2026-31431 [MEDIUM] CVE-2026-31431 kernel: crypto: algif_aead - Revert to operating out-of-place
CVE-2026-31431 kernel: crypto: algif_aead - Revert to operating out-of-place
In the Linux kernel, the following vulnerability has been resolved:
crypto: algif_aead - Revert to operating out-of-place
This mostly reverts commit 72548b093ee3 except for the copying of
the associated data.
There is no benefit in operating in-place in algif_aead since the
source and destination come from different mappings. Get rid of
all the complexity added for in-place operation and just copy the
AD directly.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/T
https://git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130chttps://git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fchttps://git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667https://git.kernel.org/stable/c/8b88d99341f139e23bdeb1027a2a3ae10d341d82https://git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875bhttps://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5https://git.kernel.org/stable/c/ce42ee423e58dffa5ec03524054c9d8bfd4f6237https://git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8http://www.openwall.com/lists/oss-security/2026/04/29/23http://www.openwall.com/lists/oss-security/2026/04/29/25http://www.openwall.com/lists/oss-security/2026/04/29/26http://www.openwall.com/lists/oss-security/2026/04/30/10http://www.openwall.com/lists/oss-security/2026/04/30/11http://www.openwall.com/lists/oss-security/2026/04/30/12http://www.openwall.com/lists/oss-security/2026/04/30/14http://www.openwall.com/lists/oss-security/2026/04/30/15http://www.openwall.com/lists/oss-security/2026/04/30/16http://www.openwall.com/lists/oss-security/2026/04/30/17http://www.openwall.com/lists/oss-security/2026/04/30/18http://www.openwall.com/lists/oss-security/2026/04/30/2http://www.openwall.com/lists/oss-security/2026/04/30/20http://www.openwall.com/lists/oss-security/2026/04/30/5http://www.openwall.com/lists/oss-security/2026/04/30/6http://www.openwall.com/lists/oss-security/2026/05/01/10http://www.openwall.com/lists/oss-security/2026/05/01/12http://www.openwall.com/lists/oss-security/2026/05/01/15http://www.openwall.com/lists/oss-security/2026/05/01/16http://www.openwall.com/lists/oss-security/2026/05/01/17http://www.openwall.com/lists/oss-security/2026/05/01/18http://www.openwall.com/lists/oss-security/2026/05/01/2http://www.openwall.com/lists/oss-security/2026/05/01/22http://www.openwall.com/lists/oss-security/2026/05/01/23http://www.openwall.com/lists/oss-security/2026/05/01/24http://www.openwall.com/lists/oss-security/2026/05/01/3http://www.openwall.com/lists/oss-security/2026/05/02/14http://www.openwall.com/lists/oss-security/2026/05/02/15http://www.openwall.com/lists/oss-security/2026/05/02/16http://www.openwall.com/lists/oss-security/2026/05/02/17http://www.openwall.com/lists/oss-security/2026/05/02/18http://www.openwall.com/lists/oss-security/2026/05/02/19http://www.openwall.com/lists/oss-security/2026/05/02/20http://www.openwall.com/lists/oss-security/2026/05/02/21http://www.openwall.com/lists/oss-security/2026/05/02/23http://www.openwall.com/lists/oss-security/2026/05/02/24http://www.openwall.com/lists/oss-security/2026/05/02/25http://www.openwall.com/lists/oss-security/2026/05/02/4http://www.openwall.com/lists/oss-security/2026/05/02/5http://www.openwall.com/lists/oss-security/2026/05/02/6http://www.openwall.com/lists/oss-security/2026/05/02/7http://www.openwall.com/lists/oss-security/2026/05/02/8http://www.openwall.com/lists/oss-security/2026/05/03/10http://www.openwall.com/lists/oss-security/2026/05/03/12http://www.openwall.com/lists/oss-security/2026/05/03/13http://www.openwall.com/lists/oss-security/2026/05/03/3http://www.openwall.com/lists/oss-security/2026/05/03/4http://www.openwall.com/lists/oss-security/2026/05/03/5http://www.openwall.com/lists/oss-security/2026/05/03/6http://www.openwall.com/lists/oss-security/2026/05/04/1http://www.openwall.com/lists/oss-security/2026/05/04/10http://www.openwall.com/lists/oss-security/2026/05/04/11http://www.openwall.com/lists/oss-security/2026/05/04/12http://www.openwall.com/lists/oss-security/2026/05/04/13http://www.openwall.com/lists/oss-security/2026/05/04/14http://www.openwall.com/lists/oss-security/2026/05/04/2http://www.openwall.com/lists/oss-security/2026/05/04/24http://www.openwall.com/lists/oss-security/2026/05/04/27http://www.openwall.com/lists/oss-security/2026/05/04/28http://www.openwall.com/lists/oss-security/2026/05/04/29http://www.openwall.com/lists/oss-security/2026/05/04/31http://www.openwall.com/lists/oss-security/2026/05/04/8http://www.openwall.com/lists/oss-security/2026/05/04/9http://www.openwall.com/lists/oss-security/2026/05/06/5http://www.openwall.com/lists/oss-security/2026/05/07/12http://www.openwall.com/lists/oss-security/2026/05/07/2http://www.openwall.com/lists/oss-security/2026/05/08/13http://www.openwall.com/lists/oss-security/2026/05/18/3https://copy.failhttps://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170https://www.kb.cert.org/vuls/id/260001https://access.redhat.com/errata/RHSA-2026:13565https://access.redhat.com/errata/RHSA-2026:13566https://access.redhat.com/errata/RHSA-2026:13577https://access.redhat.com/errata/RHSA-2026:13578https://access.redhat.com/errata/RHSA-2026:13681https://access.redhat.com/errata/RHSA-2026:13690https://access.redhat.com/errata/RHSA-2026:13727https://access.redhat.com/errata/RHSA-2026:13729https://access.redhat.com/errata/RHSA-2026:13734https://access.redhat.com/errata/RHSA-2026:13811https://access.redhat.com/errata/RHSA-2026:13862https://access.redhat.com/errata/RHSA-2026:13885https://access.redhat.com/errata/RHSA-2026:13887https://access.redhat.com/errata/RHSA-2026:13932https://access.redhat.com/errata/RHSA-2026:13936https://access.redhat.com/errata/RHSA-2026:14097https://access.redhat.com/errata/RHSA-2026:14112https://access.redhat.com/errata/RHSA-2026:14137https://access.redhat.com/errata/RHSA-2026:14165https://access.redhat.com/errata/RHSA-2026:14230https://access.redhat.com/errata/RHSA-2026:14301
+ 26 more references
2026-04-22
Published
2026-05-01
Added to CISA KEV
Exploited in the wild