CVE-2026-31430: Linux Kernel Privilege Escalation Flaw

CVE-2026-31430 Overview

CVE-2026-31430 is an out-of-bounds read vulnerability in the Linux kernel's X.509 certificate parser. The flaw resides in the extension parsing logic, where the kernel reads the first byte of a Basic Constraints or Key Usage extension before validating the extension's length. An unprivileged local user can trigger the bug by submitting a specially crafted certificate through the keyrings(7) API. A researcher referenced as Leo reported the issue and demonstrated exploitation with a proof-of-concept disclosed privately. The maintainers have merged fixes across multiple stable kernel branches.

Critical Impact
Any unprivileged user can trigger an out-of-bounds memory read in kernel space, enabling potential information disclosure or kernel memory corruption through the keyrings API.

Affected Products

Linux kernel (mainline) prior to the commits referenced below
Linux kernel stable branches incorporating the X.509 certificate parser
Distributions shipping unpatched kernels with CONFIG_KEYS and X.509 certificate support

Discovery Timeline

2026-04-20 - CVE-2026-31430 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-31430

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the Linux kernel's X.509 certificate parser. When the parser processes certificate extensions, it dereferences the first byte of a Basic Constraints or Key Usage extension before checking whether the extension contains any data. A certificate crafted with an empty Basic Constraints or empty Key Usage extension causes the parser to read past the end of the allocated buffer.

The kernel exposes this code path through the keyrings(7) API, which any unprivileged user can invoke to load an X.509 certificate into a keyring. This makes the attack surface broadly accessible without requiring elevated privileges or special capabilities.

The EPSS score is 0.016%, reflecting low observed exploitation probability at publication. The bug class is significant in kernel context because out-of-bounds reads can leak adjacent kernel memory or trigger faults that affect system stability.

Root Cause

The parser dereferences extension->value[0] (or equivalent) to determine the encoding of the extension before validating that the extension's length field is non-zero. When the extension is empty, value[0] lies outside the allocated buffer, producing an out-of-bounds read.

Attack Vector

An unprivileged local attacker constructs a DER-encoded X.509 certificate containing a zero-length Basic Constraints or Key Usage extension. The attacker submits the certificate to the kernel via the add_key(2) or keyctl(2) system calls targeting an X.509-capable keyring. The kernel parses the certificate during ingestion and triggers the out-of-bounds access. Depending on adjacent memory layout, the read can disclose kernel data, produce inconsistent parser state, or trigger a fault.

The vulnerability is described in prose only; refer to the upstream commits (206121294, 30ab358f, 672b526d, 7fb4dadc, d702c340) for the patched parser logic.

Detection Methods for CVE-2026-31430

Indicators of Compromise

Unexpected add_key or keyctl system calls from unprivileged users submitting certificates of type asymmetric
Kernel log entries (dmesg) referencing X.509 parser errors, KASAN out-of-bounds reports, or oopses in x509_cert_parse or related symbols
Processes loading malformed DER-encoded certificates that fail validation after partial parsing

Detection Strategies

Audit keyctl and add_key syscall activity using auditd with rules targeting the asymmetric key type
Monitor kernel ring buffer messages for KASAN, UBSAN, or general protection fault traces involving X.509 parsing symbols
Correlate certificate ingestion attempts with the originating user and process to identify unprivileged accounts performing unusual key operations

Monitoring Recommendations

Enable kernel auditing for the add_key and keyctl syscalls and forward events to a central log pipeline
Track installed kernel package versions across the fleet and flag hosts running kernels below the patched stable releases
Alert on repeated certificate parsing failures originating from the same user or process, which can indicate fuzzing or exploitation attempts

How to Mitigate CVE-2026-31430

Immediate Actions Required

Apply the latest stable Linux kernel updates from your distribution that incorporate the upstream fix commits
Reboot affected systems after kernel package installation to load the patched kernel
Review which users and workloads use the keyrings API and restrict access where feasible

Patch Information

The fix has been merged across multiple stable branches. The relevant upstream commits are 206121294, 30ab358fad0c, 672b526def1f, 7fb4dadc2734, and d702c3408213. The patches add a length check before dereferencing the first byte of the Basic Constraints and Key Usage extensions. Distribution vendors will publish updated kernel packages referencing these commits.

Workarounds

Where patching is delayed, restrict access to the add_key and keyctl syscalls using seccomp filters on workloads that do not require key management
Disable user-level X.509 certificate ingestion in containerized environments via syscall allowlists in your runtime configuration
Limit local shell access on systems exposed to multi-tenant or untrusted users until the patched kernel is deployed

bash

# Verify the running kernel and compare against patched stable releases
uname -r

# Identify recent keyring activity from unprivileged users
ausearch -sc add_key,keyctl --start recent

# Example seccomp deny snippet (libseccomp pseudo-config)
# Block add_key and keyctl for workloads that do not need them
deny add_key
deny keyctl