All vulnerabilities
CVE-2026-31431

Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

Linux KernelOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationExploited in the wildAdded to KEV 1 May 2026CISA KEV
Exploit odds (EPSS)3.44%Chance of exploitation activity in the next 30 days, higher than 88% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in893d22e0135fa394db81df88697fba6032747667Also 19d43105a97be0810edbda875f2cd03f30dc130c, 961cfa271a918ad4ae452420e7c303149002875b and 2 moreCVE List
Federal deadline15 May 2026Remediation due date for US federal agenciesCISA KEV
CISA required action"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

  • 893d22e0135fa394db81df88697fba6032747667LinuxCVE List
  • 19d43105a97be0810edbda875f2cd03f30dc130cLinuxCVE List
  • 961cfa271a918ad4ae452420e7c303149002875bLinuxCVE List
  • 3115af9644c342b356f3f07a4dd1c8905cd9a6fcLinuxCVE List
  • 8b88d99341f139e23bdeb1027a2a3ae10d341d82LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 22 Apr 2026, 08:15 UTCPublishedCVE List
  2. 29 Apr 2026Exploit code publicMetasploit
  3. 1 May 2026Added to CISA KEVCISA KEV

Public exploit code and templates 1

  • Exploit moduleCopy Fail AF_ALG + authencesn Page-Cache Write 29 Apr 2026Metasploit

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.

Text from CVE List

Affected versions 18

  • Linuxaffected: 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 before 893d22e0135fa394db81df88697fba6032747667CVE List
  • Linuxaffected: 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 before 19d43105a97be0810edbda875f2cd03f30dc130cCVE List
  • Linuxaffected: 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 before 961cfa271a918ad4ae452420e7c303149002875bCVE List
  • Linuxaffected: 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 before 3115af9644c342b356f3f07a4dd1c8905cd9a6fcCVE List
  • Linuxaffected: 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 before 8b88d99341f139e23bdeb1027a2a3ae10d341d82CVE List
  • Linuxaffected: 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 before fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8CVE List
  • Linuxaffected: 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 before ce42ee423e58dffa5ec03524054c9d8bfd4f6237CVE List
  • Linuxaffected: 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 before a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5CVE List
  • Linuxaffected: 4.14CVE List
  • Linuxunaffected: all versions before 4.14CVE List
  • Linuxunaffected: 5.10.254 through 5.10.*CVE List
  • Linuxunaffected: 5.15.204 through 5.15.*CVE List
  • Linuxunaffected: 6.1.170 through 6.1.*CVE List
  • Linuxunaffected: 6.6.137 through 6.6.*CVE List
  • Linuxunaffected: 6.12.85 through 6.12.*CVE List
  • Linuxunaffected: 6.18.22 through 6.18.*CVE List
  • Linuxunaffected: 6.19.12 through 6.19.*CVE List
  • Linuxunaffected: 7.0CVE List

References 60