CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.
Overview
A logic flaw in the Linux kernel's AF_ALG AEAD interface, present since kernel 4.14, allows an unprivileged local user to perform a controlled 4-byte write into the page cache of any readable file on the system. Because the corrupted page is never marked dirty for writeback, the on-disk file remains intact while the in-memory version is immediately visible to all processes, including across container boundaries. By targeting a setuid binary, an attacker can achieve full root privilege escalation. The flaw affects Linux kernels from 4.14 through multiple stable branches, as well as distributions including Red Hat Enterprise Linux, Ubuntu, and Amazon Linux.
Vulnerability details
The vulnerability originates in algif_aead.c, where an in-place AEAD decryption optimization introduced in kernel 4.14 incorrectly places page cache pages into a writable output scatterlist. When a user splices a file into an AF_ALG socket, the TX scatterlist holds direct references to the kernel's cached pages of that file. During decryption, authentication tag bytes are chained onto the output RX scatterlist via sg_chain() rather than copied, leaving page cache pages inside a scatterlist the crypto algorithm treats as a writable destination, violating the boundary between kernel-managed page cache memory and user-controlled crypto buffers.
The authencesn AEAD algorithm, when presented with equal source and destination pointers, writes 4 bytes into the tag region of the output scatterlist before performing the authentication tag check. Because the tag region still references the spliced file's page cache pages, those bytes land directly in cached file content, even when decryption fails with -EBADMSG. An attacker with a local user account opens an AF_ALG socket bound to the authencesn template, splices a readable target file such as a setuid binary, and submits crafted decryption requests to overwrite chosen offsets. Repeated requests patch multiple locations, and because the page cache is shared across the host, corruption crosses container boundaries immediately.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor for AF_ALG socket creation (socket family AF_ALG, type SOCK_SEQPACKET) combined with splice syscalls referencing setuid or other sensitive executables in the same process context, a pattern not produced by normal application workloads.
- Audit for unexpected privilege changes, specifically setuid binary execution resulting in UID 0, from processes that used AF_ALG sockets or splice syscalls shortly before execution and did not previously hold elevated privileges.
Remediation
Additional hardening
- Update the Linux kernel to a fixed release: 5.10.254 or later in the 5.10 branch, or 5.15.204 or later in the 5.15 branch. See References for fixed commits across all other stable branches.
- Disable the algif_aead module on hosts where userspace AEAD crypto via AF_ALG is not required: add 'install algif_aead /bin/false' to /etc/modprobe.d/ and unload the module with rmmod algif_aead, removing the attack surface entirely.
- Restrict unprivileged access to AF_ALG sockets using seccomp profiles or LSM policy (AppArmor or SELinux) to deny socket(AF_ALG, ...) calls for non-privileged workloads, reducing the set of processes that can reach the vulnerable code path.
- For containerized environments, apply the module disable or seccomp restriction at the host level, since the page cache is shared across all containers on a node and exploitation in one container affects the host and sibling containers.
Key dates
References
- https://git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130c
- http://www.openwall.com/lists/oss-security/2026/04/29/23
- https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/
- https://xint.io/blog/copy-fail-linux-distributions#the-fix-6
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/about/
- https://nvd.nist.gov/vuln/detail/CVE-2026-31431
- https://git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fc
- https://git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667
Frequently asked questions
Does CVE-2026-31431 affect my FedRAMP authorization?
If Linux Kernel runs inside your authorization boundary, yes. CVE-2026-31431 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of May 15, 2026 has already passed. For a FedRAMP-authorized service, an unpatched KEV in the boundary is an assessor finding. An overdue one is a finding your assessor and sponsoring agency can see right now. Your options are to remediate immediately or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-31431?
Knox does not patch your software. Remediating Linux Kernel is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, along with continuous compliance monitoring and audit-artifact coverage that support your documentation posture for the next assessment. The fix is yours to apply; maintaining a clean compliance record while you apply it is not something you have to manage alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues, including cases like CVE-2026-31431. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving your team earlier visibility into where your boundary stands.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-31431's remediation deadline of May 15, 2026 has passed. What happens now?
If CVE-2026-31431 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult agency conversation. Closing out the finding and documenting why the deadline was missed is what keeps your authorization intact and the agency relationship on solid ground.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
