Skip to content
Fencer Vulns
high 7.8

CVE-2026-31431 kev in the critical feed json

crypto: algif_aead - Revert to operating out-of-place

published 2026-04-22 6 mo ago modified 2026-10-15 25 d ago also EUVD-2026-24639

cvss
7.8
version 3.1, CNA
cisa kev
Exploited
added 2026-05-01
epss
98.1%
EPSS 98.1% chance of exploitation in 30 days, percentile 99.9%
public exploits
1
Metasploit

Summary

In the Linux kernel, the following vulnerability has been resolved:

crypto: algif_aead - Revert to operating out-of-place

This mostly reverts commit 72548b093ee3 except for the copying of the associated data.

There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

Patch / fix

cisa required action "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  • Linux Linux 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.22, 6.19.12, 7.0
  • Siemens SIMATIC CN 4100 V6.0
  • Siemens SIMATIC HMI MTP1000 Unified Basic V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1000 Unified Comfort Panel V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1000 Unified Comfort Panel hygienic V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1000, Unified Comfort Panel neutral V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extension V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1200 Unified Basic V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1200 Unified Comfort Panel V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1200 Unified Comfort Panel hygienic V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1200 Unified Comfort Panel neutral design V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom) V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top) V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom) V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extension V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top) V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1500 Unified Comfort Panel V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1500 Unified Comfort Panel hygienic V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1500 Unified Comfort Panel neutral design V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom) V21 Update 2 SR1
  • Siemens SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit V21 Update 2 SR1
  • linux Debian 12 6.1.170-1
  • linux Debian 13 6.12.85-1
  • linux Debian 14 6.19.12-1

debian advisories DEBIAN-CVE-2026-31431

  • linux Ubuntu 22.04 LTS 5.15.0-179.189
  • linux Ubuntu 24.04 LTS 6.8.0-117.117
  • linux Ubuntu 25.10 6.17.0-29.29
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1108.115
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1055.58
  • linux-aws Ubuntu 25.10 6.17.0-1015.15
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1108.117
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1058.61

ubuntu advisories UBUNTU-CVE-2026-31431

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel enterprise linux nvidia 10 6.12.0-231.12.el10nv
  • rv enterprise linux nvidia 10 6.12.0-231.12.el10nv
  • perf enterprise linux nvidia 10 6.12.0-231.12.el10nv
  • rtla enterprise linux nvidia 10 6.12.0-231.12.el10nv
  • kernel-64k enterprise linux nvidia 10 6.12.0-231.12.el10nv
  • kernel-core enterprise linux nvidia 10 6.12.0-231.12.el10nv
  • kernel-tools enterprise linux nvidia 10 6.12.0-231.12.el10nv
  • python3-perf enterprise linux nvidia 10 6.12.0-231.12.el10nv

red hat advisories RHSA-2026:33486RHSA-2026:19225RHSA-2026:19074RHSA-2026:16210RHSA-2026:16208RHSA-2026:16209

  • docker Linux Micro 6.2 29.7.2_ce-160000.8.1
  • docker Linux Micro 6.1 29.7.2_ce-slfo.1.1_11.1
  • kernel-64kb SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS, SLE High Performance Computing 15 SP5-ESPOS 5.14.21-150500.55.182.1
  • kernel-syms SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.55.182.1
  • kernel-source SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 5.14.21-150500.55.182.1
  • kernel-default SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +3 more 5.14.21-150500.55.182.1
  • kernel-obs-build SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.55.182.1
  • kernel-default-base SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 5.14.21-150500.55.182.1.150500.6.85.2

suse advisories SUSE-SU-2026:24410-1SUSE-SU-2026:24279-1SUSE-SU-2026:3595-1SUSE-SU-2026:3810-1SUSE-SU-2026:3790-1SUSE-SU-2026:23244-1

  • docker openSUSE Leap 16.0 29.7.2_ce-160000.8.1
  • docker openSUSE Tumbleweed 29.7.2_ce-41.1
  • kernel-rt openSUSE Leap 16.0 6.12.0-160000.37.1
  • dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-64kb openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-syms openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-azure openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.37.1

opensuse advisories openSUSE-SU-2026:22158-1openSUSE-SU-2026:11765-1openSUSE-SU-2026:21555-1openSUSE-SU-2026:10734-1

  • kernel AlmaLinux 10 6.12.0-211.7.3.el10_2
  • rv AlmaLinux 10 6.12.0-211.7.3.el10_2
  • perf AlmaLinux 10 6.12.0-211.7.3.el10_2
  • rtla AlmaLinux 10 6.12.0-211.7.3.el10_2
  • libperf AlmaLinux 10 6.12.0-211.7.3.el10_2
  • kernel-rt AlmaLinux 10 6.12.0-211.7.3.el10_2
  • kernel-64k AlmaLinux 10 6.12.0-211.7.3.el10_2
  • kernel-core AlmaLinux 10 6.12.0-211.7.3.el10_2

almalinux advisories ALSA-2026:19074ALSA-2026:19225ALSA-2026:13577ALSA-2026:13578ALSA-2026:13565ALSA-2026:13566

  • kernel Rocky Linux 9 5.14.0-611.54.1.el9_7.cloud.1.0
  • kernel Rocky Linux 8 4.18.0-553.123.1.el8_10.cloud.0.1
  • kernel Rocky Linux 10 6.12.0-124.55.1.el10_1
  • kernel Rocky Linux 9 5.14.0-611.54.1.el9_7
  • kernel-rt Rocky Linux 8 4.18.0-553.123.1.rt7.464.el8_10
  • kernel Rocky Linux 8 4.18.0-553.123.1.el8_10

rocky linux advisories RXSA-2026:13565RXSA-2026:13577RLSA-2026:13566RLSA-2026:13565RLSA-2026:13578RLSA-2026:13577

  • docker Alpine 3.24, Alpine 3.23 29.4.2-r0
  • docker Alpine 3.24, Alpine 3.23 29.4.3-r0

alpine advisories ALPINE-CVE-2026-31431

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel Azure Linux 3.0 6.6.137.1-1
  • kernel-hwe Azure Linux 3.0 6.12.85.1-1

azure linux advisories AZL-83249AZL-85706

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • linux Arch Linux 6.19.12-1

arch linux advisories AVG-2908

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-31431 updated cvss 7.8

kernel: crypto: algif_aead - Revert to operating out-of-place

  • Red Hat NVIDIA for RHEL 10 rv 6.12.0-211.6.el10nv, rv 6.12.0-231.12.el10nv, perf 6.12.0-211.6.el10nv, rtla 6.12.0-211.6.el10nv, perf 6.12.0-231.12.el10nv, rtla 6.12.0-231.12.el10nv, +56 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:14926
  • Red Hat CodeReady Linux Builder EUS (v.9.4) libperf 5.14.0-427.124.1.el9_4, kernel-debuginfo-common-s390x 5.14.0-427.124.1.el9_4, kernel-debuginfo-common-x86_64 5.14.0-427.124.1.el9_4, kernel-debuginfo-common-aarch64 5.14.0-427.124.1.el9_4, kernel-debuginfo-common-ppc64le 5.14.0-427.124.1.el9_4
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13932
  • Red Hat CodeReady Linux Builder EUS (v.9.6) libperf 5.14.0-570.112.1.el9_6, kernel-debuginfo-common-s390x 5.14.0-570.112.1.el9_6, kernel-debuginfo-common-x86_64 5.14.0-570.112.1.el9_6, kernel-debuginfo-common-aarch64 5.14.0-570.112.1.el9_6, kernel-debuginfo-common-ppc64le 5.14.0-570.112.1.el9_6
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:14339
  • Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-687.5.3.el9_8, rv 5.14.0-611.54.1.el9_7, perf 5.14.0-687.5.3.el9_8, rtla 5.14.0-687.5.3.el9_8, perf 5.14.0-611.54.1.el9_7, rtla 5.14.0-611.54.1.el9_7, +20 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13565
  • Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-211.7.3.el10_2, rv 6.12.0-124.55.1.el10_1, perf 6.12.0-211.7.3.el10_2, rtla 6.12.0-211.7.3.el10_2, perf 6.12.0-124.55.1.el10_1, rtla 6.12.0-124.55.1.el10_1, +20 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13566
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) perf 5.14.0-70.178.1.el9_0, kernel-devel-matched 5.14.0-70.178.1.el9_0, kernel-debug-devel-matched 5.14.0-70.178.1.el9_0, kernel-debuginfo-common-s390x 5.14.0-70.178.1.el9_0, kernel-zfcpdump-devel-matched 5.14.0-70.178.1.el9_0, kernel-debuginfo-common-x86_64 5.14.0-70.178.1.el9_0, +2 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13936
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) perf 5.14.0-284.169.1.el9_2, rtla 5.14.0-284.169.1.el9_2, kernel-devel-matched 5.14.0-284.169.1.el9_2, kernel-64k-devel-matched 5.14.0-284.169.1.el9_2, kernel-debug-devel-matched 5.14.0-284.169.1.el9_2, kernel-debuginfo-common-s390x 5.14.0-284.169.1.el9_2, +5 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13734
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) rv 6.12.0-55.71.1.el10_0, perf 6.12.0-55.71.1.el10_0, rtla 6.12.0-55.71.1.el10_0, python3-perf 6.12.0-55.71.1.el10_0, kernel-devel-matched 6.12.0-55.71.1.el10_0, kernel-64k-devel-matched 6.12.0-55.71.1.el10_0, +7 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13887
show 31 more
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) rv 5.14.0-427.124.1.el9_4, perf 5.14.0-427.124.1.el9_4, rtla 5.14.0-427.124.1.el9_4, kernel-devel-matched 5.14.0-427.124.1.el9_4, kernel-64k-devel-matched 5.14.0-427.124.1.el9_4, kernel-debug-devel-matched 5.14.0-427.124.1.el9_4, +6 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13932
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) rv 5.14.0-570.112.1.el9_6, perf 5.14.0-570.112.1.el9_6, rtla 5.14.0-570.112.1.el9_6, python3-perf 5.14.0-570.112.1.el9_6, kernel-devel-matched 5.14.0-570.112.1.el9_6, kernel-64k-devel-matched 5.14.0-570.112.1.el9_6, +7 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:14339
  • Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-553.123.1.el8_10, kernel 4.18.0-553.123.1.el8_10, bpftool 4.18.0-553.123.1.el8_10, kernel-core 4.18.0-553.123.1.el8_10, kernel-tools 4.18.0-553.123.1.el8_10, python3-perf 4.18.0-553.123.1.el8_10, +20 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13577
  • Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-687.5.3.el9_8, kernel 5.14.0-611.54.1.el9_7, kernel-64k 5.14.0-687.5.3.el9_8, kernel-64k 5.14.0-611.54.1.el9_7, kernel-core 5.14.0-687.5.3.el9_8, kernel-core 5.14.0-611.54.1.el9_7, +62 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13565
  • Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-211.7.3.el10_2, kernel 6.12.0-124.55.1.el10_1, kernel-64k 6.12.0-211.7.3.el10_2, kernel-64k 6.12.0-124.55.1.el10_1, kernel-core 6.12.0-211.7.3.el10_2, kernel-core 6.12.0-124.55.1.el10_1, +62 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13566
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) perf 4.18.0-305.190.1.el8_4, kernel 4.18.0-305.190.1.el8_4, bpftool 4.18.0-305.190.1.el8_4, kernel-core 4.18.0-305.190.1.el8_4, kernel-tools 4.18.0-305.190.1.el8_4, python3-perf 4.18.0-305.190.1.el8_4, +8 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:14165
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) perf 4.18.0-372.191.1.el8_6, kernel 4.18.0-372.191.1.el8_6, bpftool 4.18.0-372.191.1.el8_6, kernel-core 4.18.0-372.191.1.el8_6, kernel-tools 4.18.0-372.191.1.el8_6, python3-perf 4.18.0-372.191.1.el8_6, +8 more Red Hat Enterprise Linux BaseOS E4S (v.8.6) perf 4.18.0-372.191.1.el8_6, kernel 4.18.0-372.191.1.el8_6, bpftool 4.18.0-372.191.1.el8_6, kernel-core 4.18.0-372.191.1.el8_6, kernel-tools 4.18.0-372.191.1.el8_6, python3-perf 4.18.0-372.191.1.el8_6, +20 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:14230
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) perf 4.18.0-477.139.1.el8_8, kernel 4.18.0-477.139.1.el8_8, bpftool 4.18.0-477.139.1.el8_8, kernel-core 4.18.0-477.139.1.el8_8, kernel-tools 4.18.0-477.139.1.el8_8, python3-perf 4.18.0-477.139.1.el8_8, +14 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13681
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) kernel 5.14.0-70.178.1.el9_0, bpftool 5.14.0-70.178.1.el9_0, kernel-core 5.14.0-70.178.1.el9_0, kernel-tools 5.14.0-70.178.1.el9_0, python3-perf 5.14.0-70.178.1.el9_0, kernel-modules 5.14.0-70.178.1.el9_0, +19 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13936
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) bpftool 7.0.0-284.169.1.el9_2, kernel 5.14.0-284.169.1.el9_2, kernel-64k 5.14.0-284.169.1.el9_2, kernel-core 5.14.0-284.169.1.el9_2, kernel-tools 5.14.0-284.169.1.el9_2, python3-perf 5.14.0-284.169.1.el9_2, +33 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13734
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) kernel 6.12.0-55.71.1.el10_0, kernel-64k 6.12.0-55.71.1.el10_0, kernel-core 6.12.0-55.71.1.el10_0, kernel-tools 6.12.0-55.71.1.el10_0, kernel-modules 6.12.0-55.71.1.el10_0, kernel-64k-core 6.12.0-55.71.1.el10_0, +27 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13887
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) bpftool 7.3.0-427.124.1.el9_4, kernel 5.14.0-427.124.1.el9_4, kernel-64k 5.14.0-427.124.1.el9_4, kernel-core 5.14.0-427.124.1.el9_4, kernel-tools 5.14.0-427.124.1.el9_4, python3-perf 5.14.0-427.124.1.el9_4, +33 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13932
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) kernel 5.14.0-570.112.1.el9_6, kernel-64k 5.14.0-570.112.1.el9_6, kernel-core 5.14.0-570.112.1.el9_6, kernel-tools 5.14.0-570.112.1.el9_6, kernel-modules 5.14.0-570.112.1.el9_6, kernel-64k-core 5.14.0-570.112.1.el9_6, +31 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:14339
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) perf 4.18.0-305.190.1.el8_4, kernel 4.18.0-305.190.1.el8_4, bpftool 4.18.0-305.190.1.el8_4, kernel-core 4.18.0-305.190.1.el8_4, kernel-tools 4.18.0-305.190.1.el8_4, python3-perf 4.18.0-305.190.1.el8_4, +8 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:14165
  • Red Hat Enterprise Linux BaseOS TUS (v.8.6) perf 4.18.0-372.191.1.el8_6, kernel 4.18.0-372.191.1.el8_6, bpftool 4.18.0-372.191.1.el8_6, kernel-core 4.18.0-372.191.1.el8_6, kernel-tools 4.18.0-372.191.1.el8_6, python3-perf 4.18.0-372.191.1.el8_6, +8 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:14230
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) perf 4.18.0-477.139.1.el8_8, kernel 4.18.0-477.139.1.el8_8, bpftool 4.18.0-477.139.1.el8_8, kernel-core 4.18.0-477.139.1.el8_8, kernel-tools 4.18.0-477.139.1.el8_8, python3-perf 4.18.0-477.139.1.el8_8, +8 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13681
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-687.5.3.el9_8, libperf 5.14.0-611.54.1.el9_7, kernel-debuginfo-common-s390x 5.14.0-687.5.3.el9_8, kernel-debuginfo-common-s390x 5.14.0-611.54.1.el9_7, kernel-debuginfo-common-x86_64 5.14.0-687.5.3.el9_8, kernel-debuginfo-common-aarch64 5.14.0-687.5.3.el9_8, +4 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13565
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-211.7.3.el10_2, libperf 6.12.0-124.55.1.el10_1, kernel-debuginfo-common-s390x 6.12.0-211.7.3.el10_2, kernel-debuginfo-common-s390x 6.12.0-124.55.1.el10_1, kernel-debuginfo-common-x86_64 6.12.0-211.7.3.el10_2, kernel-debuginfo-common-aarch64 6.12.0-211.7.3.el10_2, +4 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13566
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) libperf 6.12.0-55.71.1.el10_0, kernel-debuginfo-common-s390x 6.12.0-55.71.1.el10_0, kernel-debuginfo-common-x86_64 6.12.0-55.71.1.el10_0, kernel-debuginfo-common-aarch64 6.12.0-55.71.1.el10_0, kernel-debuginfo-common-ppc64le 6.12.0-55.71.1.el10_0
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13887
  • Red Hat Enterprise Linux CRB (v. 8) kernel-debuginfo-common-x86_64 4.18.0-553.123.1.el8_10, kernel-debuginfo-common-aarch64 4.18.0-553.123.1.el8_10, kernel-debuginfo-common-ppc64le 4.18.0-553.123.1.el8_10
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13577
  • Red Hat Enterprise Linux NFV (v. 8) kernel-rt 4.18.0-553.123.1.rt7.464.el8_10, kernel-rt-kvm 4.18.0-553.123.1.rt7.464.el8_10, kernel-rt-core 4.18.0-553.123.1.rt7.464.el8_10, kernel-rt-modules 4.18.0-553.123.1.rt7.464.el8_10, kernel-rt-debug-kvm 4.18.0-553.123.1.rt7.464.el8_10, kernel-rt-debug-core 4.18.0-553.123.1.rt7.464.el8_10, +4 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13578
  • Red Hat Enterprise Linux NFV E4S (v.9.0) kernel-rt 5.14.0-70.178.1.rt21.250.el9_0, kernel-rt-kvm 5.14.0-70.178.1.rt21.250.el9_0, kernel-rt-core 5.14.0-70.178.1.rt21.250.el9_0, kernel-rt-modules 5.14.0-70.178.1.rt21.250.el9_0, kernel-rt-debug-kvm 5.14.0-70.178.1.rt21.250.el9_0, kernel-rt-debug-core 5.14.0-70.178.1.rt21.250.el9_0, +4 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:14137
  • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-687.5.3.el9_8, kernel-rt 5.14.0-611.54.1.el9_7, kernel-rt-64k 5.14.0-687.5.3.el9_8, kernel-rt-64k 5.14.0-611.54.1.el9_7, kernel-rt-core 5.14.0-687.5.3.el9_8, kernel-rt-core 5.14.0-611.54.1.el9_7, +34 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13565
  • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-211.7.3.el10_2, kernel-rt 6.12.0-124.55.1.el10_1, kernel-rt-64k 6.12.0-211.7.3.el10_2, kernel-rt-64k 6.12.0-124.55.1.el10_1, kernel-rt-core 6.12.0-211.7.3.el10_2, kernel-rt-core 6.12.0-124.55.1.el10_1, +34 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13566
  • Red Hat Enterprise Linux Real Time E4S (v.9.0) kernel-rt 5.14.0-70.178.1.rt21.250.el9_0, kernel-rt-core 5.14.0-70.178.1.rt21.250.el9_0, kernel-rt-modules 5.14.0-70.178.1.rt21.250.el9_0, kernel-rt-debug-core 5.14.0-70.178.1.rt21.250.el9_0, kernel-rt-debug-modules 5.14.0-70.178.1.rt21.250.el9_0, kernel-rt-modules-extra 5.14.0-70.178.1.rt21.250.el9_0, +2 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:14137
  • Red Hat Enterprise Linux Real Time E4S (v.9.2) kernel-rt 5.14.0-284.169.1.rt14.454.el9_2, kernel-rt-core 5.14.0-284.169.1.rt14.454.el9_2, kernel-rt-modules 5.14.0-284.169.1.rt14.454.el9_2, kernel-rt-debug-core 5.14.0-284.169.1.rt14.454.el9_2, kernel-rt-modules-core 5.14.0-284.169.1.rt14.454.el9_2, kernel-rt-debug-modules 5.14.0-284.169.1.rt14.454.el9_2, +4 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:14301
  • Red Hat Enterprise Linux Real Time EUS (v. 10.0) kernel-rt 6.12.0-55.71.1.el10_0, kernel-rt-64k 6.12.0-55.71.1.el10_0, kernel-rt-core 6.12.0-55.71.1.el10_0, kernel-rt-modules 6.12.0-55.71.1.el10_0, kernel-rt-64k-core 6.12.0-55.71.1.el10_0, kernel-rt-debug-core 6.12.0-55.71.1.el10_0, +14 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13887
  • Red Hat Enterprise Linux Real Time EUS (v.9.4) kernel-rt 5.14.0-427.124.1.el9_4, kernel-rt-core 5.14.0-427.124.1.el9_4, kernel-rt-modules 5.14.0-427.124.1.el9_4, kernel-rt-debug-core 5.14.0-427.124.1.el9_4, kernel-rt-modules-core 5.14.0-427.124.1.el9_4, kernel-rt-debug-modules 5.14.0-427.124.1.el9_4, +4 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13932
  • Red Hat Enterprise Linux Real Time EUS (v.9.6) kernel-rt 5.14.0-570.112.1.el9_6, kernel-rt-64k 5.14.0-570.112.1.el9_6, kernel-rt-core 5.14.0-570.112.1.el9_6, kernel-rt-modules 5.14.0-570.112.1.el9_6, kernel-rt-64k-core 5.14.0-570.112.1.el9_6, kernel-rt-debug-core 5.14.0-570.112.1.el9_6, +14 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:14339
  • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-687.5.3.el9_8, kernel-rt 5.14.0-611.54.1.el9_7, kernel-rt-core 5.14.0-687.5.3.el9_8, kernel-rt-core 5.14.0-611.54.1.el9_7, kernel-rt-modules 5.14.0-687.5.3.el9_8, kernel-rt-modules 5.14.0-611.54.1.el9_7, +14 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13565
  • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-211.7.3.el10_2, kernel-rt 6.12.0-124.55.1.el10_1, kernel-rt-core 6.12.0-211.7.3.el10_2, kernel-rt-core 6.12.0-124.55.1.el10_1, kernel-rt-modules 6.12.0-211.7.3.el10_2, kernel-rt-modules 6.12.0-124.55.1.el10_1, +14 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:13566

15 more fixed, 2 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-265-04 updated cvss 7.8

Siemens SIPLUS and SIMATIC Products

  • Siemens SIMATIC AX Runtime Core Linux Common Debian Siemens SIMATIC AX Runtime Core Linux Common Debian arm64 Siemens SIMATIC AX Runtime Core Linux Platform Container Common Debian Development Siemens SIMATIC AX Runtime Core Linux VMWare Development
    affected: mitigation, no fix available
  • Siemens SIMATIC CN 4100 < 6.0
    affected: fixed in V6.0, mitigation support.industry.siemens.com
  • Siemens SIMATIC HMI MTP400 Unified Basic (6AV2123-3DB32-0AW0) < 21.0.2.1 Siemens SIMATIC HMI MTP700 Unified Basic (6AV2123-3GB32-0AW0) < 21.0.2.1
    affected: fixed in V21, mitigation support.industry.siemens.com
  • Siemens SIMATIC HMI MTP700 Unified Comfort Panel (6AV2128-3GB06-0AX1) < 21.0.2.1 Siemens SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB40-0AX0) < 21.0.2.1 Siemens SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB70-0AX0) < 21.0.2.1 Siemens SIMATIC HMI MTP700, Unified Comfort Panel neutral design (6AV2128-3GB36-0AX1) < 21.0.2.1
    affected: fixed in V21, mitigation support.industry.siemens.com
  • Siemens SIMATIC HMI MTP1000 Unified Basic (6AV2123-3KB32-0AW0) < 21.0.2.1
    affected: fixed in V21, mitigation support.industry.siemens.com
  • Siemens SIMATIC HMI MTP1000 Unified Comfort Panel (6AV2128-3KB06-0AX1) < 21.0.2.1 Siemens SIMATIC HMI MTP1000 Unified Comfort Panel hygienic (6AV2128-3KB40-0AX0) < 21.0.2.1 Siemens SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design (6AV2128-3KB70-0AX0) < 21.0.2.1 Siemens SIMATIC HMI MTP1000, Unified Comfort Panel neutral (6AV2128-3KB36-0AX1) < 21.0.2.1 Siemens SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3MB27-1BX0) < 21.0.2.1 Siemens SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3MB27-0BX0) < 21.0.2.1
    +4 more products
    Siemens SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3MB27-0AX0) < 21.0.2.1 Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3MB57-1BX0) < 21.0.2.1 Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3MB57-0BX0) < 21.0.2.1 Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3MB57-0AX0) < 21.0.2.1
    affected: fixed in V21, mitigation support.industry.siemens.com
  • Siemens SIMATIC HMI MTP1200 Unified Basic (6AV2123-3MB32-0AW0) < 21.0.2.1
    affected: fixed in V21, mitigation support.industry.siemens.com
  • Siemens SIMATIC HMI MTP1200 Unified Comfort Panel (6AV2128-3MB06-0AX1) < 21.0.2.1 Siemens SIMATIC HMI MTP1200 Unified Comfort Panel hygienic (6AV2128-3MB40-0AX0) < 21.0.2.1 Siemens SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design (6AV2128-3MB70-0AX0) < 21.0.2.1 Siemens SIMATIC HMI MTP1200 Unified Comfort Panel neutral design (6AV2128-3MB36-0AX1) < 21.0.2.1 Siemens SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3QB27-1BX0) < 21.0.2.1 Siemens SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3QB27-0BX0) < 21.0.2.1
    +11 more products
    Siemens SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3QB27-0AX0) < 21.0.2.1 Siemens SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3QB57-1BX0) < 21.0.2.1 Siemens SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3QB57-0BX0) < 21.0.2.1 Siemens SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3QB57-0AX0) < 21.0.2.1 Siemens SIMATIC HMI MTP1500 Unified Comfort Panel (6AV2128-3QB06-0AX1) < 21.0.2.1 Siemens SIMATIC HMI MTP1500 Unified Comfort Panel hygienic (6AV2128-3QB40-0AX0) < 21.0.2.1 Siemens SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design (6AV2128-3QB70-0AX0) < 21.0.2.1 Siemens SIMATIC HMI MTP1500 Unified Comfort Panel neutral design (6AV2128-3QB36-0AX1) < 21.0.2.1 Siemens SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3UB27-1BX0) < 21.0.2.1 Siemens SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3UB27-0BX0) < 21.0.2.1 Siemens SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3UB27-0AX0) < 21.0.2.1
    affected: fixed in V21, mitigation support.industry.siemens.com

27 more affected in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-26-260-06 updated cvss 7.8

ABB Ability Edgenius

  • ABB Gateway - bE100 Ability Edgenius >=3.2.0.0, <3.2.4.1 ABB Gateway - E3100C Ability Edgenius >=3.2.0.0, <3.2.4.1 ABB Server - vE1000 Ability Edgenius >=3.2.0.0, <3.2.4.1
    affected: vendor fix, mitigation
  • ABB Gateway - bE100 Ability Edgenius 3.2.4.1 ABB Gateway - E3100C Ability Edgenius 3.2.4.1 ABB Server - vE1000 Ability Edgenius 3.2.4.1
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-26-209-04 updated cvss 7.8

Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.6 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.6 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.6 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.6 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.6
    affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-26-195-02 updated cvss 7.8

ABB Ability Edgenius

  • ABB Gateway - bE100 Ability Edgenius >=3.2.0.0, <3.2.4.1 ABB Gateway - E3100C Ability Edgenius >=3.2.0.0, <3.2.4.1 ABB Server - vE1000 Ability Edgenius >=3.2.0.0, <3.2.4.1
    affected: vendor fix, mitigation
  • ABB Gateway - bE100 Ability Edgenius 3.2.4.1 ABB Gateway - E3100C Ability Edgenius 3.2.4.1 ABB Server - vE1000 Ability Edgenius 3.2.4.1
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-26-174-06 updated cvss 7.8

Impact of Linux Kernel vulnerabilities on B&R products

  • B&R Industrial Automation GmbH APROL <APROL-AutoYaST-DVD-_V4.4-010.10.260602
    affected: vendor fix
  • B&R Industrial Automation GmbH Linux for B&R <=12 B&R Industrial Automation GmbH X20EDS410 /all
    affected: workaround, mitigation
  • B&R Industrial Automation GmbH APROL APROL-AutoYaST-DVD-_V4.4-010.10.260602
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-102-01 updated cvss 7.8

Siemens SIMATIC S7-1500 TM MFP

  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
    affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-162-05 updated cvss 7.8

Siemens SIMATIC S7-1500 CPU family

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.5
    affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Timeline

  1. Published
  2. CISA SSVC: exploitation active
  3. First public exploit (Metasploit exploit/linux/local/cve_2026_31431_copy_fail)
  4. Added to CISA KEV
  5. CISA patch deadline

Known exploited

Added
6 mo ago
Patch by
2026-05-15 (5 mo ago)
Ransomware
Not known
Required action
"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor, product
Linux, Kernel
CISA name
Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
6 mo ago

Exploit prediction

98.11% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/linux/local/cve_2026_31431_copy_fail Copy Fail AF_ALG + authencesn Page-Cache Write metasploit exploit, excellent rank, 2026-04-29
  • openwall.com http://www.openwall.com/lists/oss-security/2026/04/29/23 referenced PoC, tagged "exploit" by a source, unverified
  • openwall.com http://www.openwall.com/lists/oss-security/2026/04/29/26 referenced PoC, tagged "exploit" by a source, unverified
  • openwall.com http://www.openwall.com/lists/oss-security/2026/04/30/5 referenced PoC, tagged "exploit" by a source, unverified
  • xint.io https://xint.io/blog/copy-fail-linux-distributions#the-fix-6 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/theori-io/copy-fail-CVE-2026-31431 referenced PoC, tagged "exploit" by a source, unverified
  • openwall.com http://www.openwall.com/lists/oss-security/2026/04/30/18 referenced PoC, tagged "exploit" by a source, unverified
  • copy.fail https://copy.fail referenced PoC, tagged "exploit" by a source, unverified
  • websec.net https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux
  • Siemens SIMATIC AX Runtime Core Linux Common Debian
  • Siemens SIMATIC AX Runtime Core Linux Common Debian arm64
  • Siemens SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
  • Siemens SIMATIC AX Runtime Core Linux VMWare Development
  • Siemens SIMATIC CN 4100
  • Siemens SIMATIC HMI MTP1000 Unified Basic
  • Siemens SIMATIC HMI MTP1000 Unified Comfort Panel
  • Siemens SIMATIC HMI MTP1000 Unified Comfort Panel hygienic
  • Siemens SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design
  • Siemens SIMATIC HMI MTP1000, Unified Comfort Panel neutral
  • Siemens SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom)
  • Siemens SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit
  • Siemens SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top)
  • Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom)
  • Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extension
  • Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top)
  • Siemens SIMATIC HMI MTP1200 Unified Basic
  • Siemens SIMATIC HMI MTP1200 Unified Comfort Panel
  • Siemens SIMATIC HMI MTP1200 Unified Comfort Panel hygienic
  • Siemens SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design
  • Siemens SIMATIC HMI MTP1200 Unified Comfort Panel neutral design
  • Siemens SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom)
  • Siemens SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit
  • Siemens SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top)
  • Siemens SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom)
  • Siemens SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extension
  • Siemens SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top)
  • Siemens SIMATIC HMI MTP1500 Unified Comfort Panel
  • Siemens SIMATIC HMI MTP1500 Unified Comfort Panel hygienic
  • Siemens SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design
  • Siemens SIMATIC HMI MTP1500 Unified Comfort Panel neutral design
  • Siemens SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom)
  • Siemens SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit
  • Siemens SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top)
  • Siemens SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom)
  • Siemens SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extension
  • Siemens SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top)
  • Siemens SIMATIC HMI MTP1900 Unified Comfort Panel
  • Siemens SIMATIC HMI MTP1900 Unified Comfort Panel hygienic
  • Siemens SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design
  • Siemens SIMATIC HMI MTP1900 Unified Comfort Panel neutral design
  • Siemens SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom)
  • Siemens SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit
  • Siemens SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top)
  • Siemens SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom)
  • Siemens SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extension
  • Siemens SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top)
  • Siemens SIMATIC HMI MTP2200 Unified Comfort Hygienic
  • Siemens SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design

Classification

Weakness
  • CWE-669 Incorrect Resource Transfer Between Spheres
  • CWE-1288 Improper Validation of Consistency within Input
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.