CVE-2026-31677

What it actually does

This is a local Linux kernel denial-of-service vulnerability in the AF_ALG crypto socket interface. The vulnerable receive path can extract more receive scatter-gather data than the socket receive-buffer budget should allow, causing receive-side accounting to diverge from the actual amount of data attached to a crypto request. A local user that can open and use AF_ALG sockets can trigger abnormal resource consumption or kernel failure conditions, impacting system availability. The flaw does not provide confidentiality or integrity impact by itself and is not remotely exploitable according to the supplied CVSS vector.

Why it matters to the business

Successful exploitation can cause affected Linux systems to become unstable, hang, or crash, interrupting workloads hosted on those systems. The risk is primarily to multi-user Linux servers, shared compute environments, container hosts, CI/build workers, and systems where untrusted or low-privileged local users can execute code. EPSS is currently very low and there is no known CISA KEV listing or known exploit maturity in the provided data, so broad active exploitation is not indicated; however, kernel availability issues can still create operational outages if triggered intentionally or accidentally.

How an attack unfolds

An attacker first obtains the ability to run code as a local low-privileged user on an affected Linux system. They then create AF_ALG crypto sockets, typically using the skcipher interface, and submit data in a way that causes recvmsg processing to request more receive-side scatterlist data than the remaining receive-buffer budget should permit. On vulnerable kernels, the AF_ALG receive path uses readability as a gate but does not properly limit each extraction to the remaining receive-buffer budget. Repeated or carefully sized requests can cause receive-side accounting inconsistencies and resource exhaustion or kernel instability. The patched behavior limits each extraction to the remaining budget and rejects recvmsg when skcipher cannot obtain enough receive space for at least one chunk while more data remains.

How to fix it

Upgrade the Linux kernel to a vendor release that includes the upstream fix for the AF_ALG receive scatterlist budgeting issue. Because no exact fixed versions were provided, use the relevant distribution or appliance vendor advisory to identify the corrected kernel package for each supported platform. Where immediate patching is not possible, reduce exposure by preventing untrusted local code execution, limiting shell access, isolating shared workloads, and applying least-privilege controls to users and containers. Consider disabling or restricting access to AF_ALG functionality only if supported and validated for the environment, because kernel crypto interfaces may be used by legitimate applications. Reboot into the patched kernel after installation; installing kernel packages without booting the fixed kernel does not remediate the running system.

How to confirm the fix worked

Confirm the running kernel, not just the installed package, is updated to a vendor build containing the fix. Validate with commands such as `uname -r` and the distribution package manager, then compare against the vendor advisory for this vulnerability. Review whether AF_ALG is available by checking for loaded crypto socket modules such as `af_alg`, `algif_skcipher`, or related entries, but treat module presence as exposure context rather than proof of vulnerability. In high-assurance environments, run vendor-provided regression tests or a safe proof-of-concept in a non-production test system to confirm that crafted AF_ALG recvmsg activity is rejected rather than destabilizing the kernel. Monitor after patching for absence of recurring kernel crashes, soft lockups, or AF_ALG-related warnings.

Typical attack path

1. Gain local code execution on an affected Linux system as an unprivileged or otherwise low-privileged user.
2. Open AF_ALG sockets and select a kernel crypto algorithm path, such as skcipher.
3. Send crafted data and control receive sizes to exercise the AF_ALG recvmsg path.
4. Trigger RX scatterlist extraction that exceeds the intended receive-buffer accounting budget.
5. Repeat or tune the requests until the kernel becomes unstable, hangs, or crashes, causing a denial of service.

How to detect it

Detection should focus on signs of local denial-of-service activity and AF_ALG crypto socket abuse. Review kernel logs from journald, syslog, kmsg, crash dumps, and EDR telemetry for kernel panic, soft lockup, hung task, general protection fault, or warning messages occurring near AF_ALG, algif_skcipher, skcipher, recvmsg, or crypto socket activity. If auditd or eBPF syscall telemetry is available, look for unusual local processes repeatedly creating AF_ALG sockets and calling sendmsg/recvmsg at high frequency, especially from user-writable paths such as /tmp, /dev/shm, home directories, CI workspaces, or container writable layers. Correlate crashes or reboots with local login sessions, newly executed binaries, container workloads, and privilege boundaries. Because this vulnerability primarily causes availability impact, there may be no durable compromise artifact; absence of a file-based IOC does not rule out attempted exploitation.

• af_alg
• algif_skcipher
• skcipher
• recvmsg
• sendmsg
• AF_ALG
• kernel panic
• BUG: unable to handle kernel
• WARNING: CPU:
• soft lockup
• hung task
• general protection fault
• /proc/crypto
• /dev/shm/
• /tmp/

What your security team should do

• Prioritize patching multi-user Linux systems, shared hosting, container hosts, build infrastructure, research clusters, and any servers where untrusted users can run local code.
• Track the applicable Linux distribution advisories and deploy the first fixed kernel available for each supported platform; reboot systems into the patched kernel.
• Inventory systems exposing local user execution paths, including SSH access, developer workstations, CI runners, bastion hosts, and container platforms.
• Restrict untrusted local execution where patching is delayed, including tightening SSH access, sudo policies, container escape risk controls, and workload isolation.
• Add monitoring for kernel panic, soft lockup, hung task, and AF_ALG-related messages to detect possible exploitation or regression symptoms.
• Because EPSS is low, there is no KEV listing, and no exploit maturity is reported, sequence this behind actively exploited remote vulnerabilities, but do not defer indefinitely on shared or high-availability Linux infrastructure.