ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Vendor

SUSE

0 mentions in 7 days · 2 in 30 days · 2 total · first seen · last

Search everything

Timeline

SUSE Linux security advisory (AV26-882)

Canadian Centre for Cyber Security flagged SUSE Rancher vulnerabilities fixed in Rancher 2.15.1, urging administrators to apply updates.

Canadian Centre for Cyber Security advisory AV26-882, dated September 3, 2026, states that SUSE Rancher versions prior to 2.15.1 are affected by vulnerabilities. The Cyber Centre encourages users and administrators to review the linked SUSE advisories and Rancher GitHub release and apply the necessary updates.

Canadian Centre for Cyber Security · 12d agoAdvisory

2026-005: High Vulnerability in the Linux Kernel ("Copy Fail")

Linux kernel flaw CVE-2026-31431 ('Copy Fail', CVSS 7.8) allows unprivileged users to gain root via AF_ALG; a public PoC is out and most distros remain unpatched.

Disclosed on 29 April 2026, CVE-2026-31431 is a local privilege escalation in the Linux kernel's algif_aead module (AF_ALG crypto API), CVSS 7.8, stemming from a 2017 in-place optimisation. By chaining an AF_ALG socket operation with splice(), an unprivileged user can write 4 bytes into an arbitrary page-cache page, e.g. corrupting a setuid binary like /usr/bin/su to obtain a root shell. It affects virtually all kernels built since 2017, including Ubuntu 20.04-24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16; the mainline fix landed 1 April 2026 but no vendor packages were available as of 30 April. CERT-EU recommends the interim mitigation (disable algif_aead) and blocking AF_ALG via seccomp, prioritising Kubernetes nodes and CI/CD runners.

CERT-EU Advisoriesupdated · 8d agofirst · Apr 29, 2026Exploit / PoC 6 sourcesCVE-2026-31431

Related CVEs

  • CVE-2026-314317.8100%
    Local Privilege Escalation (Copy Fail) in Linux Kernel algif_aead Interface
    CVE-2026-31431 ('Copy Fail') is an incorrect resource transfer between spheres (CWE-669/CWE-1288) in the Linux kernel's algif_aead implementation of the AF_ALG userspace crypto interface, introduced roughly nine years ago (around 2017, per public reporting) when commit 72548b093ee3 switched AEAD operations to in-place handling even though the source and destination buffers come from different mappings. A local, unprivileged user can trigger the flaw by performing AEAD operations through the AF_ALG socket interface, causing the kernel to mishandle the copy of ciphertext and associated data. Successful exploitation provides a reliable local privilege escalation to root (C:H/I:H/A:H per the CVSS vector). Nearly every major Linux distribution and enterprise platform is exposed, including the kernel itself, Red Hat Enterprise Linux (including AUS, EUS, TUS and Update Services for SAP Solutions), OpenShift Container Platform, Amazon Linux, Ubuntu, Debian, openSUSE Leap, SUSE CaaS Platform, NixOS, and Linux-based products from Arista and Siemens. The flaw has public proof-of-concept code, a 99.9% EPSS score, and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-01, indicating exploitation in the wild (ransomware use is unknown).
    · Linux kernel (algif_aead / AF_ALG crypto interface) · Red Hat Enterprise Linux (including AUS, EUS, TUS, and Update Services for SAP Solutions) KEV PoC ×5mass

Appears with

organization Canadian Centre for Cyber Security 1product Amazon Linux 1product Linux Kernel 1product Rancher 1product Red Hat Enterprise Linux 1product SUSE Linux Enterprise 1product Ubuntu 1vendor Canonical 1vendor Red Hat 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.