CVE-2026-31677 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux kernel versions 4.14 through 7.0-rc7 should assess exposure and prioritize patching vulnerable kernel versions.

Why it matters

CVE-2026-31677 is a medium-severity vulnerability in the Linux kernel's crypto: af_alg component. It has been patched to limit RX scatterlist extraction by the receive buffer budget. Linux kernel maintainers and users should assess exposure and prioritize patching vulnerable kernel versions.

• Verify patch application to prevent potential recvmsg call rejections
• Assess Linux kernel deployment exposure to prioritize patching
• Ensure receive-side accounting matches data attached to requests

Technical summary

The Linux kernel's crypto: af_alg component has a vulnerability that could lead to receive-side accounting issues. The af_alg_get_rsgl() function did not limit RX scatterlist extraction by the receive buffer budget, potentially causing skcipher to reject recvmsg calls when unable to obtain enough RX space. This issue has been addressed by modifying the af_alg_get_rsgl() function to limit RX scatterlist extraction by the receive buffer budget, ensuring receive-side accounting matches the data attached to the request. Linux kernel maintainers and users should assess exposure and prioritize patching vulnerable kernel versions, particularly those in the 4.14 through 7.0-rc7 range.

Defensive priority

Linux kernel maintainers and users should assess exposure and prioritize patching vulnerable kernel versions.

Recommended defensive actions

• Assess exposure of Linux kernel deployments to CVE-2026-31677
• Prioritize patching for vulnerable kernel versions
• Verify patch application and test kernel functionality
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD details provide information on the vulnerability and its resolution in the Linux kernel. Multiple patch references are available for fixing the issue. Linux kernel maintainers and users should verify patch application and assess exposure to prioritize patching vulnerable kernel versions, focusing on versions 4.14 through 7.0-rc7. Evidence is based on official CVE and NVD records, with additional patch references provided for verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.