IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.8Alta KEV

CVE-2026-31431crypto: algif_aead - Revert to operating out-of-place

Linux Linux; Siemens SIMATIC AX Runtime Core Linux Common Debian; Siemens SIMATIC AX Runtime Core Linux Common Debian arm64; Siemens SIMATIC AX Runtime Core Li… Publicada: (hace 6 meses)

Explotación conocida — Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

CISA confirmó el 01.05.2026 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 15.05.2026.

Acción requerida: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/; https://xint.io/blog/copy-fail-linux-distributions#the-fix-6 ; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/about/ ; https://nvd.nist.gov/vuln/detail/CVE-2026-31431

Descripción

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

Debilidad (CWE): CWE-669CWE-1288

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
amazon amazon linux —
arista cloudvision agni 2024.4.0 – ≤ 2025.2.2
arista cloudvision portal 2024.2.0 – ≤ 2026.1.0
arista netvisor os < 7.1.0
arista velocloud edge 4.5.0 – ≤ 6.4.1
arista velocloud gateway —
arista velocloud orchestrator —
canonical ubuntu linux 14.04
debian debian linux 11.0
enterprise linux 8 —
enterprise linux nvidia 10 —
Linux Linux 4.14
linux linux kernel 4.14 – < 5.10.254
nixos nixos < 25.11
openshift 4.12 —
openshift 4.13 —
openshift 4.14 —
openshift 4.15 —
openshift 4.16 —
openshift 4.17 —
openshift 4.18 —
openshift 4.19 —
openshift 4.20 —
openshift 4.21 —
opensuse leap 15.3
redhat enterprise linux 8.0
redhat enterprise linux aus 8.4
redhat enterprise linux eus 8.4
redhat enterprise linux tus 8.6
redhat enterprise linux update services for sap solutions 8.6
redhat openshift container platform 4.12 – < 4.12.89
rhel e4s 9.0 —
rhel e4s 9.2 —
siemens simatic ax runtime —
Siemens SIMATIC AX Runtime Core Linux Common Debian 0
Siemens SIMATIC AX Runtime Core Linux Common Debian arm64 0
Siemens SIMATIC AX Runtime Core Linux Platform Container Common Debian Development 0
Siemens SIMATIC AX Runtime Core Linux VMWare Development 0
Siemens SIMATIC CN 4100 < V6.0
siemens simatic cn 4100 firmware < 6.0
Siemens SIMATIC HMI MTP1000 Unified Basic < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1000 Unified Comfort Panel < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1000 Unified Comfort Panel hygienic < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1000, Unified Comfort Panel neutral < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extension < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Unified Basic < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Unified Comfort Panel < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Unified Comfort Panel hygienic < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1200 Unified Comfort Panel neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extension < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Unified Comfort Panel < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Unified Comfort Panel hygienic < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1500 Unified Comfort Panel neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extension < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Unified Comfort Panel < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Unified Comfort Panel hygienic < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP1900 Unified Comfort Panel neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extension < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top) < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Unified Comfort Hygienic < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Unified Comfort Panel < V21 Update 2 SR1
Siemens SIMATIC HMI MTP2200 Unified Comfort Panel neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP400 Unified Basic < V21 Update 2 SR1
Siemens SIMATIC HMI MTP700 Unified Basic < V21 Update 2 SR1
Siemens SIMATIC HMI MTP700 Unified Comfort Panel < V21 Update 2 SR1
Siemens SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design < V21 Update 2 SR1
Siemens SIMATIC HMI MTP700, Unified Comfort Panel neutral design < V21 Update 2 SR1
siemens simatic hmi unified comfort panels firmware < 21.0
Siemens SIMATIC IoT2050 Advanced 0
siemens simatic iot2050 advanced firmware —
siemens simatic ipc ied-os —
Siemens SIMATIC IPC Industrial Edge Device OS (IED-OS) 0
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 – < V3.1.7
siemens simatic s7-1500 cpu 1518-4 pn/dp mfp firmware 3.1.5 –
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6 – < V3.1.7
siemens simatic s7-1500 cpu 1518f-4 pn/dp mfp firmware 3.1.5 –
Siemens SIMATIC S7-1500 TM MFP 0
siemens simatic s7-1500 tm mfp firmware —
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem 0
Siemens SIPLUS HMI MTP1000 Unified Basic < V21 Update 2 SR1
Siemens SIPLUS HMI MTP1000 Unified Comfort < V21 Update 2 SR1
Siemens SIPLUS HMI MTP1200 Unified Basic < V21 Update 2 SR1
Siemens SIPLUS HMI MTP1200 Unified Comfort < V21 Update 2 SR1
Siemens SIPLUS HMI MTP400 Unified Basic < V21 Update 2 SR1
Siemens SIPLUS HMI MTP700 Unified Basic < V21 SP2 Update 1
Siemens SIPLUS HMI MTP700 Unified Comfort < V21 Update 2 SR1
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 – < V3.1.7
siemens siplus s7-1500 cpu 1518-4 pn/dp mfp firmware 3.1.5 –
suse basesystem module 15
suse caas platform 4.0
suse development tools module 15
suse enterprise storage 6.0
suse legacy module 15
suse linux enterprise desktop 11
suse linux enterprise high availability extension 15
suse linux enterprise high performance computing 15.0
suse linux enterprise live patching 12
suse linux enterprise micro 5.0
suse linux enterprise real time 15.0
suse linux enterprise server 11
suse linux enterprise workstation extension 15
suse linux micro 6.0
suse manager proxy 4.0
suse manager retail branch server 4.0
suse manager server 4.0
suse openstack cloud 9.0
suse openstack cloud crowbar 9.0
suse public cloud module 15
suse realtime module 15

Referencias y parches

Coincidencias CPE (NVD) (60)
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 4.14 < 5.10.254
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 5.11 < 5.15.204
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 5.16 < 6.1.170
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.2 < 6.6.137
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.7 < 6.12.85
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.13 < 6.18.22
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.19 < 6.19.12
  • cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.12 < 4.12.89
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.13 < 4.13.66
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.14 < 4.14.65
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.15 < 4.15.64
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.16 < 4.16.61
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.17 < 4.17.53
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.18 < 4.18.40
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.19 < 4.19.30
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.20 < 4.20.21
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.21 < 4.21.14
  • cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_aus:8.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_aus:8.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_tus:8.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*
  • cpe:2.3:o:amazon:amazon_linux:-:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:-:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:leap:15.3:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:leap:15.4:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:leap:15.5:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:leap:15.6:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:caas_platform:4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:enterprise_storage:6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:enterprise_storage:7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:enterprise_storage:7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:manager_proxy:4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:manager_proxy:4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:manager_proxy:4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:manager_proxy:4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:manager_retail_branch_server:4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:manager_retail_branch_server:4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:manager_retail_branch_server:4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:suse:manager_retail_branch_server:4.3:*:*:*:*:*:*:*

CVE recientes del mismo producto — Ubuntu 20.04 LTS

7.7Alta
CVE-2026-109518

APT RCE via hard link reuse

Debian APT; Ubuntu APT

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…

Sin puntuación
CVE-2026-98912

ALSA: seq: oss: Reject reads that cannot fit the next event

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd_seq_oss_read() checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it f…

7.5Alta
CVE-2026-98911

dpaa2-switch: fix the error path in dpaa2_switch_rx()

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd() function is called in order to free the FD. This is incorrect sinc…