---
cve: "CVE-2026-31739"
severity: "HIGH"
cvss: 8.8
epss: "0.4%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-05-01 14:14:35"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T04:56:08+01:00"
---

# CVE-2026-31739

> 8.8 HIGH

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

crypto: tegra - Add missing CRYPTO_ALG_ASYNC

The tegra crypto driver failed to set the CRYPTO_ALG_ASYNC on its
asynchronous algorithms, causing the crypto API to select them for users
that request only synchronous algorithms.  This causes crashes (at
least).  Fix this by adding the flag like what the other drivers do.
Also remove the unnecessary CRYPTO_ALG_TYPE_* flags, since those just
get ignored and overridden by the registration function anyway.

## CNA-Record (Kanon, cvelistV5)

- CNA: **Linux**
- State: PUBLISHED
- Stand: 2026-10-19 19:06:07
- CNA-CVSS: **8.8** (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-617** — Reachable Assertion
  The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
- **CWE-20** — Improper Input Validation
  The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

## Patch verfügbar (OSV)

- Kernel ≥ 6.12.81
- Kernel ≥ 6.18.22
- Kernel ≥ 6.19.12

## BSI-Hinweise (deutsch)

- [Linux Kernel: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-1346) — _BSI-Einstufung: hoch_
  Ein entfernter Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Root-Rechte zu erlangen, um Sicherheitsmechanismen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen oder Auswirkungen unbestimmter Art zu erzielen.

## Referenzen

- <https://git.kernel.org/stable/c/bdbf027a4504b4a86740de6beb6d18a957331839>
- <https://git.kernel.org/stable/c/3aea268b6d5cde3b087df9eeecc3bc620aa09513>
- <https://git.kernel.org/stable/c/429d05565eb19ee545d8a8395991372adbe4daf3>
- <https://git.kernel.org/stable/c/4b56770d345524fc2acc143a2b85539cf7d74bc1>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-31739/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_