{"schema":"threatline.record/2","record":{"id":"CVE-2026-31431","aliases":[],"summary":"Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability","details":"Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.","categories":["Operating systems"],"product":"Kernel","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-31431","source_modified_at":"2026-10-15T01:16:12.771Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Linux","vendor":"Linux","versions":[{"version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","lessThan":"893d22e0135fa394db81df88697fba6032747667","status":"affected","versionType":"git"},{"version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","lessThan":"19d43105a97be0810edbda875f2cd03f30dc130c","status":"affected","versionType":"git"},{"version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","lessThan":"961cfa271a918ad4ae452420e7c303149002875b","status":"affected","versionType":"git"},{"version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","lessThan":"3115af9644c342b356f3f07a4dd1c8905cd9a6fc","status":"affected","versionType":"git"},{"version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","lessThan":"8b88d99341f139e23bdeb1027a2a3ae10d341d82","status":"affected","versionType":"git"},{"version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","lessThan":"fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8","status":"affected","versionType":"git"},{"version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","lessThan":"ce42ee423e58dffa5ec03524054c9d8bfd4f6237","status":"affected","versionType":"git"},{"version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","lessThan":"a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-31431","source_modified_at":"2026-10-15T01:16:12.771Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Linux","vendor":"Linux","versions":[{"version":"4.14","status":"affected"},{"version":"0","lessThan":"4.14","status":"unaffected","versionType":"semver"},{"version":"5.10.254","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.204","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.170","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.137","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.85","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.22","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"6.19.12","lessThanOrEqual":"6.19.*","status":"unaffected","versionType":"semver"},{"version":"7.0","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-31431","source_modified_at":"2026-10-15T01:16:12.771Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"893d22e0135fa394db81df88697fba6032747667","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-31431","source_modified_at":"2026-10-15T01:16:12.771Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"19d43105a97be0810edbda875f2cd03f30dc130c","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-31431","source_modified_at":"2026-10-15T01:16:12.771Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"961cfa271a918ad4ae452420e7c303149002875b","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-31431","source_modified_at":"2026-10-15T01:16:12.771Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"3115af9644c342b356f3f07a4dd1c8905cd9a6fc","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-31431","source_modified_at":"2026-10-15T01:16:12.771Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"8b88d99341f139e23bdeb1027a2a3ae10d341d82","basis":"first unaffected version stated in the CVE record"}],"cvss":7.8,"severity":"High","kev":{"listed":true,"date_added":"2026-05-01","due_date":"2026-05-15","required_action":"\"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware_campaign_use":"Unknown"},"epss":{"probability":0.03437,"percentile":0.8891,"score_date":"2026-10-23"},"published_at":"2026-04-22T08:15:10.123Z","modified_at":"2026-10-15T01:16:12.771Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-31431","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-15T01:16:12.771Z"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2026_31431_copy_fail.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-04-29"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-31431","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","Metasploit","EPSS"],"references":[{"source":"CVE List","url":"https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/","tags":["mitigation"]},{"source":"CVE List","url":"https://xint.io/blog/copy-fail-linux-distributions#the-fix-6","tags":["mitigation"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/about/","source":"CISA KEV"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31431","source":"CISA KEV"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130c"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875b"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fc"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/8b88d99341f139e23bdeb1027a2a3ae10d341d82"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/ce42ee423e58dffa5ec03524054c9d8bfd4f6237"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5"},{"source":"CVE List","url":"https://github.com/theori-io/copy-fail-CVE-2026-31431","tags":["exploit"]},{"source":"CVE List","url":"https://access.redhat.com/security/cve/cve-2026-31431#cve-details-mitigation","tags":["mitigation"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-31431","tags":["government-resource"]},{"source":"CVE List","url":"https://copy.fail"},{"source":"CVE List","url":"https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170"},{"source":"CVE List","url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"},{"source":"CVE List","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"CVE List","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"CVE List","url":"https://cert-portal.siemens.com/productcert/html/ssa-328642.html"},{"source":"CVE List","url":"https://access.redhat.com/security/cve/CVE-2026-31431","tags":["vdb-entry","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460538","tags":["issue-tracking","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31431.json","tags":["x_sadp-csaf-vex"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:14926","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:33486","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:14097","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:14112","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:15087","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:14773","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:13729","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:13885","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:13727","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:13690","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:13862","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:13811","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:13887","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:13566","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:19074","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:13936","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:13734","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:13932","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:14339","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:13565","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:19225","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:13577","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:15976","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:14165","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:14230","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:16111","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:13681","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:16210","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:16209","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:16208","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:16063","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:16018","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:15978","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:13578","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:14137","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:14301","tags":["vendor-advisory","x_refsource_REDHAT"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"no","technical_impact":"total","assessed_at":"2026-04-29T00:00:00+00:00"},"exploits":[{"source":"Metasploit","kind":"Exploit module","name":"Copy Fail AF_ALG + authencesn Page-Cache Write","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2026_31431_copy_fail.rb","date":"2026-04-29","added":"2026-05-14","check":true}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"vendor and product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-15T01:16:12.771Z","content_hash":"39f95ca8b61428b9abaf2cd29740430ee28bba15c98aac88acc9f33d0c1e2722"}}