boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-31431HIGH
Linux Linux — crypto: algif_aead - Revert to operating out-of-place
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS    %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .9991   100.0   YES
AFFECTED
  Product  Versions                                    Fixed
  Linux    72548b093ee38a6d4f2a19e6ef1948ae05c181f7 –  —
  Linux    4.14 –                                      5.10.254
TIMELINE
  Mar 9   Reserved by Linux
  May 1   Added to CISA KEV, remediation due 2026-05-15
  May 1   Published (CNA: Linux)
  Jul 28  ENRICHED — CVE-2026-31431 (Linux Kernel). Received CVSS 7.8 and CPE data from NVD.
  Jul 28  EXPLOIT PUBLISHED — CVE-2026-31431 (Linux Kernel). Public exploit reference added.
  Aug 4   PATCH SHIPPED — CVE-2026-31431 (Linux). Fixed in Linux 5.10.254.
CWE-669 · CNA: Linux · CVSS v3.1 · 126 references · NVD status: Analyzed · KEV due May 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

Lifecycle

Complete event history — 6 events, chronological
DateEventDetail
March 9, 2026ReservedReserved by Linux
May 1, 2026KEV ADDEDAdded to CISA KEV, remediation due 2026-05-15
May 1, 2026PublishedPublished (CNA: Linux)
July 28, 2026ENRICHEDENRICHED — CVE-2026-31431 (Linux Kernel). Received CVSS 7.8 and CPE data from NVD.
July 28, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2026-31431 (Linux Kernel). Public exploit reference added.
August 4, 2026PATCH SHIPPEDPATCH SHIPPED — CVE-2026-31431 (Linux). Fixed in Linux 5.10.254.

Affected

Affected products and packages — 2 rows
VendorProduct / PackageEcosystemVersion introducedFixed
LinuxLinux—72548b093ee38a6d4f2a19e6ef1948ae05c181f7—
LinuxLinux—4.145.10.254

Weaknesses

CWE-669

References (126)

Related

Authoritative record: CVE-2026-31431 at cve.org

Vendors: linux

Weaknesses: CWE-669

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-31431 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.