[KEV] CVE-2026-31431 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-31431 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-31431 is an incorrect resource transfer between spheres vulnerability in the Linux Kernel that exposes local privilege escalation as the primary attack surface.

Technical Detail

The flaw involves improper handling of resource transfers across security boundaries within the Linux Kernel, allowing an attacker with local access to manipulate kernel-level resources in ways that were not intended. By exploiting this boundary confusion, an unprivileged local user can escalate their privileges to a higher level, potentially achieving root or kernel-level access on the affected system. The full technical mechanism, including the specific kernel subsystem involved and the precise trigger conditions, has not been publicly detailed at this time.

Exploitation Status

CISA has confirmed active exploitation in the wild, adding this vulnerability to the Known Exploited Vulnerabilities catalog on May 1, 2026. The exploit maturity is rated Operational, meaning a reliable and functional exploit exists and is being used in real-world attacks, not merely as a proof of concept.

Who Is Targeting This

No specific threat actor attribution has been confirmed at this time. No campaigns, targeted sectors, or named groups have been associated with exploitation of this vulnerability in available intelligence.

What To Do

Per CISA's Known Exploited Vulnerabilities catalog, federal agencies under BOD 22-01 are required to apply patches or mitigations promptly; given the May 1, 2026 KEV listing date, remediation should be treated as urgent. Organizations running affected Linux Kernel versions should apply the latest available kernel update from their distribution vendor immediately. Where patching cannot be applied immediately, consider restricting local user access on sensitive systems, enforcing least-privilege principles, and monitoring for anomalous privilege escalation activity in system logs. The CVSS score of 0.0 should not be interpreted as low risk given confirmed active exploitation; the KEV listing and operational exploit maturity are the authoritative risk signals here.