All Products
Search

This Product

    :CVE-2026-31431 kernel upgrade notice

    Document Center

    :CVE-2026-31431 kernel upgrade notice

    Last Updated:May 13, 2026

    This document describes the impact of the CVE-2026-31431 Linux kernel local privilege escalation vulnerability and its official remediation. Alibaba Cloud provides a patched minor kernel version to address this vulnerability, which restores your system's security without requiring any application code modifications.

    Background

    CVE-2026-31431 is a local privilege escalation vulnerability in the Linux kernel's algif_aead module.

    The algif_aead module is used for kernel-space Authenticated Encryption with Associated Data (AEAD) operations. A performance optimization patch introduced a page cache sharing mechanism, which allows an attacker to write 4 bytes of controlled data to the page cache of any readable file. By modifying a setuid binary file, an attacker can escalate local privileges to gain root permissions.

    Remediation

    Alibaba Cloud adopts the official upstream fix, which addresses the vulnerability by releasing a new minor kernel version.

    The fix rolls back the unsafe in-place operation in the algif_aead module, reverting to the safer out-of-place mode for encryption and decryption:

    • Before the fix: Encryption/decryption operations reuse the page cache, which introduces a risk of local privilege escalation.

    • After the fix: Encryption/decryption operations use a separate buffer.

    Important

    Because this fix rolls back an upstream performance optimization, it may slightly decrease performance in some encryption and decryption scenarios. We recommend that you closely monitor your application performance metrics and system stability after the upgrade.

    Affected and fixed versions

    Operating system

    Affected version

    Fixed version

    Alibaba Cloud Linux 2

    kernel-4.19.91-28.4 and earlier versions

    kernel-4.19.91-28.5.al7 or later

    Alibaba Cloud Linux 3

    kernel-5.10.134-19.3 and earlier versions

    kernel-5.10.134-19.3.1.al8 or later

    Alibaba Cloud Linux 4

    kernel-6.6.102-5.3 and earlier versions

    kernel-6.6.102-5.3.1.alnx4 or later

    Upgrade the kernel

    Important

    Running yum update kernel upgrades the current kernel to the latest version in the repository. For example:

    kernel-5.10.134-16 → kernel-5.10.134-19.3.1. The upgrade process may involve compatibility changes or performance regressions. You must strictly control the upgrade pace and perform service health checks and canary validation.

    Step 1: Create a snapshot

    Before upgrading, create snapshots for your system disk and data disks. This allows you to quickly roll back if an issue occurs.

    Path: ECS console > Instance Details > Block Storage > Create Snapshot

    Step 2: Install the patched kernel

    Method 1: Online upgrade with YUM (recommended)

    # 1. Clean the cache.
sudo yum clean all

# 2. Install the patched kernel.
sudo yum update kernel

# 3. Confirm the default boot kernel.
sudo grubby --default-kernel

# Expected output: /boot/vmlinuz-<fixed_version_number>
# If the output shows the fixed version, no further action is needed. If not, proceed to step 4.

# 4. (Optional) Set the new kernel as the default.
# First, view all kernels and their index values.
sudo grubby --info=ALL | grep -E "^index|^kernel"

# Set the new kernel as the default (replace with the actual index value).
sudo grubby --set-default-index=<new_kernel_index>

    Method 2: Offline installation with RPM

    # 1. Download the corresponding RPM package from an official Alibaba Cloud channel.

# 2. Install the kernel.
sudo rpm -ivh kernel-*.rpm

# 3. Confirm the default boot kernel.
sudo grubby --default-kernel

# Expected output: /boot/vmlinuz-<fixed_version_number>
# If the output shows the fixed version, no further action is needed. If not, proceed to step 4.

# 4. (Optional) Set the new kernel as the default.
# First, view all kernels and their index values.
sudo grubby --info=ALL | grep -E "^index|^kernel"

# Set the new kernel as the default (replace with the actual index value).
sudo grubby --set-default-index=<new_kernel_index>

    Step 3: Reboot the system

    sudo reboot

    Step 4: Verify the fix

    # Check the kernel version.
uname -r

# Expected output: The fixed version or a later version (see the preceding version table).

    Upgrade impact

    For users who do not need the CVE fix

    If you upgrade the kernel for reasons other than fixing this vulnerability:

    • If you do not use the algif_aead module: The upgrade has no impact. System functionality and performance remain unchanged.

    • For workloads that use the AF_ALG interface for encryption or decryption: Functionality remains normal after the upgrade, but the performance of the algif_aead module decreases by approximately 5%.

    Note

    • If your workloads do not depend on algif_aead and you have no security or compliance requirements, you can schedule the upgrade window based on your needs.

    • If you have security or compliance requirements, or if your workloads use this module, we recommend that you upgrade as soon as possible.

    Performance impact

    The fix rolls back an upstream performance optimization and switches from shared cache mode to separate buffer mode, which may cause a slight performance decrease. For example:

    • Based on libkcapi tests

    • Using the AES(AESNI) GCM(ASM-RFC) 256 algorithm

    • The performance of the algif_aead module decreases by approximately 5%.

    Note

    • Before the fix: Uses in-place mode with a shared page cache. This offers higher performance but introduces a security risk.

    • After the fix: Uses out-of-place mode with a separate buffer, which provides higher security.

    We recommend performing the upgrade during off-peak hours and monitoring your application metrics for 10 to 30 minutes afterward.

    Rollback procedure

    If you encounter compatibility or performance issues after the upgrade, you can roll back by using one of the following methods.

    Method 1: Snapshot rollback (recommended)

    1. Stop the ECS instance.

    2. On the console, roll back the disk by using the snapshot that you created before the upgrade.

    3. Start the instance and verify the status of your workloads.

    Method 2: Switch the default boot kernel

    # 1. List the installed kernel versions.
grep menuentry /boot/grub2/grub.cfg | cut -d "'" -f2

# 2. Set the previous kernel as the default for startup.
sudo grubby --set-default-index=<previous_kernel_index>

# 3. Reboot the system.
sudo reboot

# 4. (Optional) Uninstall the new kernel and its components (using 5.10.134-19.3.1.al8 as an example).
sudo yum remove kernel-5.10.134-19.3.1.al8 \
    kernel-core-5.10.134-19.3.1.al8 \
    kernel-modules-5.10.134-19.3.1.al8 \
    kernel-modules-extra-5.10.134-19.3.1.al8 \
    kernel-modules-internal-5.10.134-19.3.1.al8

    Notes

    1. Reboot required: You must reboot the system for the kernel upgrade to take effect. If you cannot reboot the system, see Mitigation by Disabling the AF_ALG Protocol Family in Alibaba Cloud Linux.

    2. Workload validation: If your workloads call the AF_ALG interface to use the algif_aead module, you must carefully validate their functional correctness and performance after the upgrade.

    3. Compatibility: If your workloads use custom kernel modules, ensure they are compatible with the target kernel version before you upgrade.

    4. Monitoring: After the upgrade, closely monitor the performance baselines and error logs of crypto-intensive workloads.