Look up another CVE · open CVE-2026-31431 in the interactive tracker
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
Published 2026-04-22 (6 months ago) by the Linux kernel CNA. Subsystem crypto. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-31431 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDSA-6243-1 · 2026-05-01 · text | 6.1.170-1 | Update the kernel and reboot. DSA-6243-1 shipped the fix on 2026-05-01, in 6.1.170-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6238-1 · 2026-04-30 · text | 6.12.85-1 | Update the kernel and reboot. DSA-6238-1 shipped the fix on 2026-04-30, in 6.12.85-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 6.19.12-1 | Update the kernel and reboot. Fixed in 6.19.12-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 6.19.12-1 | Update the kernel and reboot. Fixed in 6.19.12-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
crypto/af_alg.c
crypto/algif_aead.c
crypto/algif_skcipher.c
include/crypto/if_alg.h
- What this is
- CRYPTO APIMAINTAINERS section matched on crypto/ · linux-crypto@vger.kernel.org · Maintained
- Kernel module
- af_alg
Check it on the machine
grep -w CONFIG_CRYPTO_USER_API /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w af_algPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_CRYPTO_USER_API
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Known to be exploited in the wild
- Added to KEV
- 2026-05-01
- Federal due date
- 2026-05-15
- Ransomware use
- unknown
- Required action
- "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Signals
- Published
- 2026-04-22 (6 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 3.44%, higher than 88.8% of all CVEssource
- CISA KEV
- listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- crypto
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.14 | 5.10.254 | 893d22e0135f |
| 4.14 | 5.15.204 | 19d43105a97b |
| 4.14 | 6.1.170 | 961cfa271a91 |
| 4.14 | 6.6.137 | 3115af9644c3 |
| 4.14 | 6.12.85 | 8b88d99341f1 |
| 4.14 | 6.18.22 | fafe0fa2995a |
| 4.14 | 6.19.12 | ce42ee423e58 |
| 4.14 | 7.0 | a664bf3d603d |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4561-1 | 2026-05-02 | bullseye 6.1.170-1~deb11u1 | tracker |
| DLA-4560-1 | 2026-05-02 | bullseye 5.10.251-3 | tracker |
| DSA-6243-1 | 2026-05-01 | bookworm 6.1.170-1 | tracker |
| DSA-6238-1 | 2026-04-30 | trixie 6.12.85-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable algif_aead path is reached through local AF_ALG socket syscalls: socket, bind, setsockopt, accept, sendmsg, and recvmsg. It is not directly reachable from remote network packets.
- AC:LAttack complexity, low
- A local attacker can construct the AF_ALG AEAD request, choose buffer layout, AAD/tag lengths, and invoke recvmsg directly. Any race or SGL layout condition is attacker-controlled from the same process.
- PR:LPrivileges required, low
- Creating and using AF_ALG AEAD sockets requires only an unprivileged local user on systems with CRYPTO_USER_API_AEAD enabled. The traced socket, bind, setsockopt, accept, sendmsg, and recvmsg paths do not require CAP_SYS_ADMIN or other real root privileges.
- UI:NUser interaction, none
- No victim interaction is needed once the attacker has local code execution. The attacker can open and drive the AF_ALG socket entirely through syscalls.
- S:UScope, unchanged
- The issue remains within the kernel/user crypto API security authority and does not cross a VM, IOMMU, or separate sandbox boundary. This is a standard local kernel attack surface.
- C:HConfidentiality impact, high
- The removed in-place AEAD design used user-writable RX scatterlists as crypto source data and chained TX tag pages, creating a plausible decryption/authentication bypass for data protected by secret AEAD keys. Under the required uncertainty rule, this is scored as high confidentiality impact.
- I:HIntegrity impact, high
- The bug undermines AEAD authenticity by allowing source data used by the crypto operation to diverge from the data originally submitted and authenticated. This can allow forged or corrupted plaintext/ciphertext results, so integrity impact is high.
- A:HAvailability impact, high
- The vulnerable path builds complex chained scatterlists from attacker-controlled local buffers and related AF_ALG fixes show these paths can lead to scatterwalk NULL dereferences and kernel panics. A local attacker can repeatedly trigger the operation, so availability impact is high.