CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

CSIRTS triage

What

The vulnerability allows for privilege escalation due to incorrect resource transfer between spheres.

Who is affected

All mainstream Linux distributions shipping a kernel built since 2017 are affected.

Urgency

Remediation is urgent due to the availability of a public proof-of-concept exploit and its critical severity.

Action

Apply the interim mitigation immediately.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CISA Known Exploited Vulnerabilities (US · database · site)

Severity

critical

Published

2026-05-01

Exploitation

Observed in the wild (CISA KEV)

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-31431

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Exploitation confirmedCVE-2026-31431Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 99.9% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• highexploited[UPDATE] [high] Linux Kernel: Multiple vulnerabilitiescert-bund
• unknownexploitedOngoing updates on Copy.fail and variantsaws
• unknownexploitedDirty Frag and other issues in Amazon Linux kernelsaws
• unknownexploitedCVE-2026-31431aws
• unknownexploitedMultiple vulnerabilities in SUSE Linux kernel (August 14, 2026)cert-fr-avis
• highexploited[UPDATE] [high] Linux Kernel (Dirty Frag): Multiple vulnerabilities allow gaining administrator rightscert-bund
• highexploitedCVE-2026-31431: crypto: algif_aead - Revert to operating out-of-placemsrc
• high[UPDATE] [high] IBM QRadar SIEM: Multiple vulnerabilitiescert-bund
• unknownexploitedSiemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFPcisa
• high[NEW] [high] Oracle Communications: Multiple vulnerabilitiescert-bund
• criticalexploitedABB Ability Edgeniuscisa
• unknownexploitedUSN-8528-1: Linux kernel (Xilinx ZynqMP) vulnerabilitiesubuntu

Recent advisories for Linux Kernel Incorrect

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• highCVE-2026-74674: In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush ad…nvd · 2026-08-22
• unknownCVE-2026-72490: In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix st…nvd · 2026-08-15
• unknownCVE-2026-72269: In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: fix potent…nvd · 2026-08-15
• unknownCVE-2026-72212: In the Linux kernel, the following vulnerability has been resolved: mm/memory_hotplug: fix inc…nvd · 2026-08-15
• criticalCVE-2026-72069: In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorr…nvd · 2026-08-15
• criticalCVE-2026-68477: In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with…nvd · 2026-08-15

More from CISA Known Exploited Vulnerabilities

• criticalCVE-2026-60004: Gitea Code Injection Vulnerability2026-08-25
• criticalCVE-2026-21962: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerabil…2026-08-24
• criticalCVE-2026-73570: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability2026-08-21
• criticalCVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerability2026-08-20
• criticalCVE-2026-72530: TrueConf Server Code Injection Vulnerability2026-08-20