CVE-2026-31431

FAUCET Score

OVERVIEW CVE-2026-31431 is a vulnerability in the Linux kernel's crypto/algif_aead module involving improper handling of associated data during AEAD (Authenticated Encryption with Associated Data) cryptographic operations. The issue stems from unnecessary in-place operation logic that introduced complexity without functional benefit, as source and destination data originate from separate memory mappings. SEVERITY The vulnerability carries a CVSS score that is not yet assigned, though the EPSS metric indicates an extremely low probability of exploitation at 0.00007. The attack complexity and vector details remain unavailable due to incomplete scoring data. However, the FAUCET Risk Score of 20/100 suggests this represents a low-risk vulnerability with minimal immediate threat to deployed systems. EXPLOITATION STATUS There is no evidence of active exploitation. The vulnerability has not been added to the Known Exploited Vulnerabilities (KEV) catalog, and the Hot List status is marked as inactive, indicating no widespread malicious activity or public exploit availability. Community attention and urgency around this issue are minimal.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 4.14, < 5.10.254CPE matchmatch criteria	cpe:2.3:o:linux:linux_kernel::::::::
		>= 5.11, < 5.15.204CPE matchmatch criteria	cpe:2.3:o:linux:linux_kernel::::::::
		>= 5.16, < 6.1.170CPE matchmatch criteria	cpe:2.3:o:linux:linux_kernel::::::::
		>= 6.2, < 6.6.137CPE matchmatch criteria	cpe:2.3:o:linux:linux_kernel::::::::
		>= 6.7, < 6.12.85CPE matchmatch criteria	cpe:2.3:o:linux:linux_kernel::::::::

CVSS Data

CVSS version used by this source: 3.1

7.8HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

1.8

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

94.55%

Probability of exploitation in next 30 days

EPSS Percentile

99.8%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

Added to KEV · May 1, 2026

Metasploit: Copy Fail AF_ALG + authencesn Page-Cache Write · Apr 29, 2026

Nuclei: CVE-2026-31431 · Jun 17, 2026

This CVE's current EPSS score of 0.9455 is in the 100th percentile among its peer group of 17,070 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (142)

microsoftpatch availablevia msrc

Product: 21300-17084Fixed in: 6.12.85.1-1

microsoftpatch availablevia msrc

Product: azl3 kernel-hwe 0:6.12-1 on Azure Linux 3.0Fixed in: 6.12.85.1-1

microsoftpatch availablevia msrc

Product: azl3 kernel 6.6.134.1-2 on Azure Linux 3.0Fixed in: 6.6.137.1-1

microsoftpatch availablevia msrc

Product: 21248-17084Fixed in: 6.6.137.1-1