Skip to content

CVE · Exploited · On CISA KEV

CVE-2026-31431

Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

7.8
CVSS 3.1
2
stories
MAY 1
added to KEV
Severity
7.8 High · vendor score
Vendor
Linux
Product
Kernel
Published
Apr 22, 2026
Added to KEV
May 1, 2026
KEV deadline
May 15, 2026
Ransomware use
Unknown
Weakness
CWE-669, CWE-1288

What it is

Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 2 stories

Newest first ↑
  1. AIA Copy Fail FAQThe latest branded bug is a slick, portable LPE in many Linux kernels going back to 2017.DENNIS FISHER · 3 MIN
  2. Supply ChainNew Dirty Frag Linux Bug EmergesThe vulnerability class is a potent new iteration of kernel bugs that corrupt the page cache of read-only files and is a follow-on to the recently disclosed Copy Fail Linux LPE bug.DENNIS FISHER · 3 MIN

Official references

7 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorylore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkhFixgit.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130cFixgit.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fcFixgit.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667