CVE-2026-31431:

CVE-2026-31431 is a high-severity Linux kernel vulnerability in the `crypto: algif_aead` subsystem caused by incorrect in-place resource transfer between memory mappings, classified as CWE-669 (Incorrect Resource Transfer Between Spheres), which can be exploited by a local user to achieve full privilege escalation.

CVE-2026-31431 is a HIGH severity (CVSS 3.1 score 7.8) local privilege escalation vulnerability in the Linux kernel's `crypto: algif_aead` subsystem. The flaw originates from commit `72548b093ee3`, which incorrectly implemented in-place AEAD cryptographic operations despite the source and destination buffers residing in distinct memory mappings. This incorrect resource transfer between spheres (CWE-669) enables a local attacker with low privileges to exploit the AF_ALG socket interface to perform unauthorized writes to kernel page cache memory, ultimately achieving full root access. The vulnerability has been actively exploited in the wild, as confirmed by its inclusion in the CISA Known Exploited Vulnerabilities catalog with a remediation due date of May 15, 2026. Public proof-of-concept exploits are available, including the "copy.fail" exploit and code published by Theori. The affected kernel version range spans 4.14 through 6.19.x, with broad impact across major Linux distributions.