CVE-2026-31431: Linux kernel crypto privilege escalation

CVE-2026-31431 is a vulnerability in the Linux kernel's crypto/algif_aead module. The flaw involves an unsafe in-place operation on memory areas with different mappings in authenticated encryption (AEAD) operations. The vulnerability affects Linux systems that process cryptographic operations through this module.

Severity is rated CVSS 7.8 (high). The kernel maintainer identified the issue and reverted commit 72548b093ee3, restoring out-of-place operation. Significant signal: a PoC appeared on GitHub on November 3, 2026, demonstrating exploitation as a local privilege escalation (LPE), confirming real-world impact.

For defenders, priority is to update the Linux kernel to the version containing the fix. Verify in production systems whether the algif_aead module is enabled and in use. Analyze kernel logs for suspicious activity on cryptographic operations. If possible, implement access restrictions to the module or disable it if not strictly necessary. Closely monitor systems with untrusted local access.