CVE coverage
View on NVD →
CVE-2026-31431
CVSS 7.8
Actively exploited (KEV)
7 detections found
In the Linux kernel, the following vulnerability has been resolved:
crypto: algif_aead - Revert to operating out-of-place
This mostly reverts commit 72548b093ee3 except for the copying of
the associated data.
There is no benefit in operating in-place in algif_aead since the
source and destination come from different mappings. Get rid of
all the complexity added for in-place operation and just copy the
AD directly.
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Potential Copy Fail (CVE-2026-31431) Exploitation via AF_ALG Socket | production | 2026-09-18 |
| splunk | Linux PF_ALG Registration Outside of Boot Window | production | 2026-07-17 |
| splunk | Linux Dirty Frag Kernel Privilege Escalation | production | 2026-07-06 |
| splunk | Linux Auditd Copy Fail Privilege Escalation | production | 2026-05-13 |
| sigma | Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator | experimental | 2026-05-09 |
| splunk | Linux Malformed Auth Entry | production | 2026-05-06 |
| sigma | Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator | experimental | 2026-04-30 |