{"cve":"CVE-2026-31431","nvd":{"published":"2026-04-22T09:16:21.270","modified":"2026-09-08T15:13:07.273","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from different mappings.  Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-669","CWE-1288"],"references":["https://git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130c","https://git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fc","https://git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667","https://git.kernel.org/stable/c/8b88d99341f139e23bdeb1027a2a3ae10d341d82","https://git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875b"],"products":["amazon:amazon_linux","arista:cloudvision_agni","arista:cloudvision_portal","arista:netvisor_os","arista:velocloud_edge","arista:velocloud_gateway","arista:velocloud_orchestrator","canonical:ubuntu_linux","debian:debian_linux","linux:linux_kernel","nixos:nixos","opensuse:leap","redhat:enterprise_linux","redhat:enterprise_linux_aus","redhat:enterprise_linux_eus","redhat:enterprise_linux_tus","redhat:enterprise_linux_update_services_for_sap_solutions","redhat:openshift_container_platform","siemens:simatic_ax_runtime","siemens:simatic_cn_4100_firmware","siemens:simatic_hmi_unified_comfort_panels_firmware","siemens:simatic_iot2050_advanced_firmware","siemens:simatic_ipc_ied-os","siemens:simatic_s7-1500_cpu_1518-4_pn\\/dp_mfp_firmware","siemens:simatic_s7-1500_cpu_1518f-4_pn\\/dp_mfp_firmware","siemens:simatic_s7-1500_tm_mfp_firmware","siemens:siplus_s7-1500_cpu_1518-4_pn\\/dp_mfp_firmware","suse:basesystem_module","suse:caas_platform","suse:development_tools_module","suse:enterprise_storage","suse:legacy_module","suse:linux_enterprise_desktop","suse:linux_enterprise_high_availability_extension","suse:linux_enterprise_high_performance_computing","suse:linux_enterprise_live_patching","suse:linux_enterprise_micro","suse:linux_enterprise_real_time","suse:linux_enterprise_server","suse:linux_enterprise_workstation_extension","suse:linux_micro","suse:manager_proxy","suse:manager_retail_branch_server","suse:manager_server","suse:openstack_cloud","suse:openstack_cloud_crowbar","suse:public_cloud_module","suse:realtime_module"],"source":"nvd","synced_at":"2026-10-19T22:30:49.762551342+00:00"},"epss":{"cve":"CVE-2026-31431","score":0.98114,"percentile":0.99912,"date":"2026-10-31"},"kev":{"cve":"CVE-2026-31431","date_added":"2026-05-01","due_date":"2026-05-15","vendor":"Linux","product":"Kernel","known_ransomware":false},"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}