CVE intelligenceCISA KEV

CVE-2026-31431

Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

Published Apr 22, 2026Sources checked Oct 28, 2026

7.8HIGHCVSS out of 10

What this means

Actively exploited

CISA lists CVE-2026-31431 in its Known Exploited Vulnerabilities catalog, which means exploitation has been observed. The entry applies to Linux Kernel.

"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploit: Cataloged public exploit.

Rapid7 Metasploit: Copy Fail AF_ALG + authencesn Page-Cache Write (2026-09-23 21:40:29.350562+00)
Rapid7 catalogs an exploit module for this CVE. Module availability does not establish exploitation in the wild or applicability to your environment.

What to do next

Remediation and response

AWS Security Bulletins guidance

Vendor revision: Oct 19, 2026

As a best practice, AWS recommends that you apply all security patches and software version updates as soon as they become available.

Microsoft Security Response Center guidance

Vendor revision: Sep 25, 2026

CBL-Mariner Releases Release Notes

Vendor-listed releases

6.6.137.1-1
6.12.85.1-1

Ubuntu Security Notices guidance

Vendor revision: Aug 27, 2026

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf.

CISA KEVListedObserved exploitation

EPSS98.1%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-31431?

In the Linux kernel, the following vulnerability has been resolved:

crypto: algif_aead - Revert to operating out-of-place

This mostly reverts commit 72548b093ee3 except for the copying of the associated data.

There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

Source: NVD

CISA says:"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.CISA catalog due date May 15, 2026