CVE Watch8 de set. de 2026

CVE-2026-31431

Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

CVSS

7.8

Alta

EPSS

98.1%

p100

KEV

SIM

1 de mai. de 2026

Exploit Today

0-100

Publicado: 22 de abr. de 2026 · Última mod.: 8 de set. de 2026 · CWE-669 · CWE-1288

EPSS · 30d

3.4%EPSS · 30 dias98.1%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

Linux / Kernel

Vulnerabilidade

Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

Adicionado ao KEV

1 de mai. de 2026

Corrigir até

15 de mai. de 2026

Uso conhecido em ransomware

Não

Descrição resumida

Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.

Ação necessária

"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/; https://xint.io/blog/copy-fail-linux-distributions#the-fix-6 ; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/about/ ; https://nvd.nist.gov/vuln/detail/CVE-2026-31431

Descrição técnica

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1230107.2 ALT

12.5%

——4@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.21h CVE-2026-1221246.1 MÉD

3.8%

——1On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi‑Fi coverage, the attacker may perform audio and video eavesdropping with no LED alert from the device.1d CVE-2026-89317—

12.2%

——4gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were.3d CVE-2026-1147226.5 MÉD

16.8%

——5Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were left unscoped and applied to the whole Roundcube interface instead of being confined to the message body. This allows an HTML message to restyle application chrome for UI redressing and spoofing. Upstream fixed this in the commit “Fix CSS scoping bypass in HTML messages using at-rules”.3d CVE-2026-938564.3 MÉD

31.5%

——9In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the response, resulting in the leakage of UUIDs of resources owned by other projects, in addition to the user message about the other projects' resources (which, by design, are sanitized generic messages). All Cinder deployments are affected.15d CVE-2026-1117934.3 MÉD

15.3%

——5Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.17d