CVSS score 7.8 Severity High CVE-2026-31431 Linux kernel

["'Michael Paoli' via BerkeleyLUG" <berkeleylug@googlegroups.com>]

CVSS score 7.8 Severity High CVE-2026-31431 Linux kernel

Highly easy root exploit (at least locally).
kernel.org kernel patched, various states for various distros,
if your distro doesn't have patch/update out yet, expect it soon.

Appears (I've not vetted it) there's also effective work-around to close
the hole in existing
running kernels, apparently, e.g.:

disable the algif_aead kernel module. This breaks nothing for the vast
majority of systems  dm-crypt, LUKS, IPsec, TLS, SSH, and standard
OpenSSL/GnuTLS builds all use the in-kernel crypto API directly and do
not go through AF_ALG:
echo 'install algif_aead /bin/false' >/etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true
For containerized or multi-tenant workloads, block AF_ALG socket
reation via seccomp policy regardless of patch state.

Proof-of-concept exploit already published, likely expect active exploit
attempts soon, if they've not already started.

Looks like the bug has been in Linux kernels for about 9 years.

Select references:
https://www.cve.org/CVERecord?id=CVE-2026-31431
https://www.cyberkendra.com/2026/04/a-732-byte-python-script-can-get-root.html

-- 
You received this message because you are subscribed to the Google Groups "BerkeleyLUG" group.
To unsubscribe from this group and stop receiving emails from it, send an email to berkeleylug+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/berkeleylug/CAPU_E%2Beb3gDdT2b4SXTqp8d_qn1ZOGBWZ6gKXSo%3DuKNnoSkxtQ%40mail.gmail.com.