IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
7.8Hoch KEV

CVE-2026-31431crypto: algif_aead - Revert to operating out-of-place

Linux Linux; Siemens SIMATIC AX Runtime Core Linux Common Debian; Siemens SIMATIC AX Runtime Core Linux Common Debian arm64; Siemens SIMATIC AX Runtime Core Li… Veröffentlicht: (vor 6 Monaten)

Bekannt ausgenutzt — Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

CISA hat am 01.05.2026 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 15.05.2026.

Erforderliche Maßnahme: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/; https://xint.io/blog/copy-fail-linux-distributions#the-fix-6 ; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/about/ ; https://nvd.nist.gov/vuln/detail/CVE-2026-31431

Beschreibung

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

Schwachstellentyp (CWE): CWE-669CWE-1288

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
amazon amazon linux —
arista cloudvision agni 2024.4.0 – ≤ 2025.2.2
arista cloudvision portal 2024.2.0 – ≤ 2026.1.0
arista netvisor os < 7.1.0
arista velocloud edge 4.5.0 – ≤ 6.4.1
arista velocloud gateway —
arista velocloud orchestrator —
canonical ubuntu linux 14.04
debian debian linux 11.0
enterprise linux 8 —
enterprise linux nvidia 10 —
Linux Linux 4.14
linux linux kernel 4.14 – < 5.10.254
nixos nixos < 25.11
openshift 4.12 —
openshift 4.13 —
openshift 4.14 —
openshift 4.15 —
openshift 4.16 —
openshift 4.17 —
openshift 4.18 —
openshift 4.19 —
openshift 4.20 —
openshift 4.21 —
opensuse leap 15.3
redhat enterprise linux 8.0
redhat enterprise linux aus 8.4
redhat enterprise linux eus 8.4
redhat enterprise linux tus 8.6
redhat enterprise linux update services for sap solutions 8.6
redhat openshift container platform 4.12 – < 4.12.89
rhel e4s 9.0 —
rhel e4s 9.2 —
siemens simatic ax runtime —
Siemens SIMATIC AX Runtime Core Linux Common Debian 0
Siemens SIMATIC AX Runtime Core Linux Common Debian arm64 0
Siemens SIMATIC AX Runtime Core Linux Platform Container Common Debian Development 0
Siemens SIMATIC AX Runtime Core Linux VMWare Development 0
Siemens SIMATIC CN 4100 < V6.0
siemens simatic cn 4100 firmware < 6.0
Siemens SIMATIC HMI MTP1000 Unified Basic < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1000 Unified Comfort Panel < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1000 Unified Comfort Panel hygienic < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1000, Unified Comfort Panel neutral < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extension < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Unified Basic < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Unified Comfort Panel < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Unified Comfort Panel hygienic < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Unified Comfort Panel neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extension < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Unified Comfort Panel < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Unified Comfort Panel hygienic < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Unified Comfort Panel neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extension < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Unified Comfort Panel < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Unified Comfort Panel hygienic < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Unified Comfort Panel neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extension < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Unified Comfort Hygienic < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Unified Comfort Panel < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Unified Comfort Panel neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP400 Unified Basic < V21 Update 2 SR1
Siemens SIMATIC HMI MTP700 Unified Basic < V21 Update 2 SR1
Siemens SIMATIC HMI MTP700 Unified Comfort Panel < V21 Update 2 SR1
Siemens SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP700, Unified Comfort Panel neutral design < V21 Update 2 SR1
siemens simatic hmi unified comfort panels firmware < 21.0
Siemens SIMATIC IoT2050 Advanced 0
siemens simatic iot2050 advanced firmware —
siemens simatic ipc ied-os —
Siemens SIMATIC IPC Industrial Edge Device OS (IED-OS) 0
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 – < V3.1.7
siemens simatic s7-1500 cpu 1518-4 pn/dp mfp firmware 3.1.5 –
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6 – < V3.1.7
siemens simatic s7-1500 cpu 1518f-4 pn/dp mfp firmware 3.1.5 –
Siemens SIMATIC S7-1500 TM MFP 0
siemens simatic s7-1500 tm mfp firmware —
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem 0
Siemens SIPLUS HMI MTP1000 Unified Basic < V21 Update 2 SR1
Siemens SIPLUS HMI MTP1000 Unified Comfort < V21 Update 2 SR1
Siemens SIPLUS HMI MTP1200 Unified Basic < V21 Update 2 SR1
Siemens SIPLUS HMI MTP1200 Unified Comfort < V21 Update 2 SR1
Siemens SIPLUS HMI MTP400 Unified Basic < V21 Update 2 SR1
Siemens SIPLUS HMI MTP700 Unified Basic < V21 SP2 Update 1
Siemens SIPLUS HMI MTP700 Unified Comfort < V21 Update 2 SR1
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 – < V3.1.7
siemens siplus s7-1500 cpu 1518-4 pn/dp mfp firmware 3.1.5 –
suse basesystem module 15
suse caas platform 4.0
suse development tools module 15
suse enterprise storage 6.0
suse legacy module 15
suse linux enterprise desktop 11
suse linux enterprise high availability extension 15
suse linux enterprise high performance computing 15.0
suse linux enterprise live patching 12
suse linux enterprise micro 5.0
suse linux enterprise real time 15.0
suse linux enterprise server 11
suse linux enterprise workstation extension 15
suse linux micro 6.0
suse manager proxy 4.0
suse manager retail branch server 4.0
suse manager server 4.0
suse openstack cloud 9.0
suse openstack cloud crowbar 9.0
suse public cloud module 15
suse realtime module 15

Referenzen und Patches

CPE-Treffer (NVD) (60)
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 4.14 < 5.10.254
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 5.11 < 5.15.204
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 5.16 < 6.1.170
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.2 < 6.6.137
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.7 < 6.12.85
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.13 < 6.18.22
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.19 < 6.19.12
  • cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.12 < 4.12.89
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.13 < 4.13.66
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.14 < 4.14.65
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.15 < 4.15.64
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.16 < 4.16.61
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.17 < 4.17.53
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.18 < 4.18.40
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.19 < 4.19.30
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.20 < 4.20.21
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.21 < 4.21.14
  • cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_aus:8.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_aus:8.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_tus:8.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*
  • cpe:2.3:o:amazon:amazon_linux:-:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:-:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:leap:15.3:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:leap:15.4:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:leap:15.5:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:leap:15.6:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:caas_platform:4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:enterprise_storage:6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:enterprise_storage:7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:enterprise_storage:7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:manager_proxy:4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:manager_proxy:4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:manager_proxy:4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:manager_proxy:4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:manager_retail_branch_server:4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:manager_retail_branch_server:4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:manager_retail_branch_server:4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:manager_retail_branch_server:4.3:*:*:*:*:*:*:*

Neue CVEs im selben Produkt — Ubuntu 20.04 LTS

Ohne Score
CVE-2026-98912

ALSA: seq: oss: Reject reads that cannot fit the next event

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd_seq_oss_read() checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it f…

7.5Hoch
CVE-2026-98911

dpaa2-switch: fix the error path in dpaa2_switch_rx()

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd() function is called in order to free the FD. This is incorrect sinc…

Ohne Score
CVE-2026-98907

btrfs: protect sb_write_pointer() with invalidate lock

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb_write_pointer() with invalidate lock sb_write_pointer() reads the super block from the block device page cache using read_cache_page_gfp(). This has the same race with BLK…

Ohne Score
CVE-2026-98902

md/raid5: let stripe batch bm_seq comparison wrap-safe

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bm_seq comparison wrap-safe Once the 32-bit seq wraps, a newer bm_seq can look smaller than old, so .. covert to wrap-safe calculate way.

Ohne Score
CVE-2026-98900

xen/gntalloc: validate grant count before allocation

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntalloc_ioctl_alloc() allocates the grant-id array before checking whether the requested count fits within the global grant limit. Coun…