Linux Kernel algif_aead In-place Operation Vulnerability Leading to Local Privilege Escalation (CVE-2026-31431)

1. Kernel Update

Upgrade your Linux kernel to the latest stable release containing the official patches. The fix reverts the complex in-place operation and safely copies the Associated Data (AD) directly.

# For Ubuntu / Debian systems
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-generic

# For RHEL / Rocky Linux systems
sudo dnf update kernel

2. Temporary Mitigation

If your applications do not rely on the User-space Crypto API (AF_ALG), you can prevent the algif_aead module from being loaded:

# Blacklist the algif_aead module
echo "blacklist algif_aead" | sudo tee /etc/modprobe.d/blacklist-algif-aead.conf

# Unload the module if currently loaded
sudo rmmod algif_aead

This vulnerability exists within the algif_aead implementation of the Linux kernel's Crypto API.

A previous optimization commit (72548b093ee3) attempted to perform in-place operations for AEAD. However, because the source and destination buffers originate from different memory mappings, operating in-place introduces severe memory management and mapping complexities (CWE-669, CWE-1288).

An attacker with local access can leverage AF_ALG sockets to trigger these mismatched mappings, leading to kernel memory corruption. Due to its inclusion in the CISA KEV catalog and an EPSS score of 0.94, this vulnerability represents a high-risk vector that requires immediate remediation.