CVE-2026-31431

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0 Linux kernel versions prior to 6.19.12

Description A flaw exists in the Linux kernel's algif aead cryptographic algorithm interface. The issue stems from an incorrect in-place operation during cryptographic processing where source and destination data mappings differ. A local attacker can exploit this by splicing a readable file into an AF ALG socket and requesting an AEAD operation. This triggers a race condition in the page-cache Copy-on-Write (CoW) path, allowing the attacker to write 4 bytes of controlled data directly into the kernel's page cache for any file they can read. Because the page cache is shared across containers and the host, this can be used to corrupt sensitive system binaries (e.g., /usr/sbin/ipset or /usr/bin/su) in memory without altering the file on disk. This allows an unprivileged user to execute arbitrary code with root privileges, potentially leading to a full container escape in Kubernetes environments by targeting privileged DaemonSets.

Recommendations Update the Linux kernel to version 7.0 or later. Update the Linux kernel to version 6.19.12 or later.