CVE-2026-31431

Linux Kernel Incorrect Resource Transfer Between Spheres (CVE-2026-31431)

Privilege Escalation Defense Evasion Persistence Last updated:

CVE-2026-31431 is a Linux Kernel vulnerability classified as CWE-669 (Incorrect Resource Transfer Between Spheres). The flaw allows improper transfer of resources across security boundaries within the kernel, potentially enabling privilege escalation or unauthorized memory access. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Attackers with local access may exploit this to escalate privileges to root or escape container boundaries.

Vulnerability Intelligence

KEV — Known Exploited

Affected Software

Vendor
Linux
Product
Kernel

Weakness (CWE)

CWE-669

Timeline

Disclosed
May 1, 2026

CVSS

7.8
High (7.0–8.9)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Write-up coming soon

What is CVE-2026-31431 Linux Kernel Incorrect Resource Transfer Between Spheres (CVE-2026-31431)?

Linux Kernel Incorrect Resource Transfer Between Spheres (CVE-2026-31431) (CVE-2026-31431) maps to the Privilege Escalation and Defense Evasion and Persistence tactics — the adversary is trying to gain higher-level permissions in MITRE ATT&CK.

This page provides production-ready detection logic for Linux Kernel Incorrect Resource Transfer Between Spheres (CVE-2026-31431), covering the data sources and telemetry it touches: Syslog, SecurityEvent, CommonSecurityLog. The queries below are rated critical severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Privilege Escalation Defense Evasion Persistence
Microsoft Sentinel / Defender
kusto 
union SecurityEvent, Syslog
| where TimeGenerated > ago(7d)
| where (EventID in (4688, 4689) and (CommandLine has_any ("exploit", "privesc", "lpe")) ) 
    or (Facility =~ "kern" and SyslogMessage has_any ("copy_to_user", "copy_from_user", "__copy_overflow", "kernel memory", "BUG:", "general protection fault", "use-after-free"))
| extend HostCustomEntity = Computer, AccountCustomEntity = Account
| project TimeGenerated, Computer, Account, EventID, CommandLine, SyslogMessage, _ResourceId
| order by TimeGenerated desc

Detects Linux kernel messages and process events indicative of CVE-2026-31431 exploitation — specifically kernel copy faults, memory boundary violations, and privilege escalation attempts on Linux hosts reporting to Microsoft Sentinel via Syslog or AMA.

critical severity medium confidence

Data Sources

Syslog SecurityEvent CommonSecurityLog

Required Tables

Syslog SecurityEvent

False Positives

  • Legitimate kernel debugging sessions generating BUG or fault messages during development
  • Stress testing or fuzzing tools running in CI/CD environments producing kernel error messages
  • Automated patch verification scripts that trigger controlled kernel error conditions

Sigma rule & cross-platform mapping

The detection logic for Linux Kernel Incorrect Resource Transfer Between Spheres (CVE-2026-31431) (CVE-2026-31431) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2026-31431 Sigma rules on detection.fyi

Platform-specific guides for CVE-2026-31431

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-06-19 Research depth: standard
References (4)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate kernel copy boundary fault via /proc/kcore read attempt

    Expected signal: Kernel message in dmesg showing access denial or fault; audit log SYSCALL record for 'open' or 'read' on /proc/kcore by non-root UID; possible kernel warning message about unauthorized memory access attempt

  2. Test 2Privilege escalation simulation via SUID binary abuse on unpatched kernel

    Expected signal: Audit log SYSCALL record showing execve of test_suid with uid!=0 but euid=0; EDR process event showing SUID execution; possible AppArmor/SELinux denial log if MAC policy is enforced

  3. Test 3Container escape boundary test via /proc/sysrq-trigger probe

    Expected signal: Host kernel log entries showing container namespace probe attempts; Docker daemon log entries for the test container; audit log entries showing file access attempts to /dev/mem or /proc/1/ from container process

Response Playbook

Triage

  1. Verify the affected Linux host's kernel version against the patched releases referenced in the kernel stable git tree (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/about/) to confirm vulnerability exposure before escalating.
  2. Check /var/log/kern.log, /var/log/syslog, and dmesg output for kernel OOPS, BUG, or general protection fault messages timestamped around the detection alert to determine if exploitation was attempted or successful.
  3. Identify the process tree that triggered the alert using 'ps auxf' and 'pstree -p' at time of detection, correlating with audit logs from /var/log/audit/audit.log to determine the originating user and parent process.
  4. Assess whether the affected host is a container host (Kubernetes node, Docker host) — CVE-2026-31431 may enable container escape in addition to local privilege escalation, significantly widening blast radius.
  5. Query your EDR or SIEM for lateral movement indicators from the affected host IP within 1 hour before and after the kernel fault timestamp, as successful exploitation may be followed immediately by credential harvesting or lateral movement.

Containment

  1. Isolate the affected Linux host at the network level (firewall rule blocking all outbound except management) immediately if kernel exploitation is confirmed, preventing post-exploitation lateral movement while preserving forensic state.
  2. Do NOT reboot the host until memory forensics have been captured — reboot destroys volatile evidence of in-memory exploitation artifacts. Use 'virsh dump' or LiME kernel module to capture a memory image before any restart.
  3. Revoke active SSH sessions and rotate credentials for all accounts that had active sessions on the host during the exploitation window, as compromised root access enables full credential extraction from /etc/shadow and memory.

Evidence Collection

  1. Capture a full memory image using the LiME (Linux Memory Extractor) kernel module: 'insmod lime.ko path=/tmp/memory.lime format=lime' — this preserves kernel heap state showing the resource transfer boundary violation in situ.
  2. Preserve the following artifacts before any remediation: /var/log/kern.log, /var/log/audit/audit.log, /proc/[suspicious_pid]/maps, /proc/[suspicious_pid]/cmdline, bash history for all users (~/.bash_history, /root/.bash_history), and a copy of currently loaded kernel modules via 'lsmod > /tmp/lsmod.txt'.
  3. Collect network connection state with 'ss -tulpn > /tmp/netstat.txt' and 'ip route > /tmp/routes.txt' to identify any backdoor listeners or routing changes made post-exploitation.

Escalation Criteria

  • ! Escalate immediately to incident response if evidence shows successful privilege escalation to root (UID=0 process with non-root parent in audit logs), as the host must be treated as fully compromised and all secrets it could access (Vault tokens, SSH keys, service credentials) rotated.
  • ! Escalate to CISO and legal/compliance if the compromised host processes PII, PHI, PCI data, or holds credentials for cloud infrastructure — CVE-2026-31431 KEV status indicates active exploitation and may trigger mandatory breach notification timelines.

Investigation Guide

Forensic Artifacts

  • > Kernel OOPS or BUG trace in /var/log/kern.log or dmesg output containing 'copy_to_user', 'copy_from_user', or '__copy_overflow' stack frames near the time of exploitation
  • > Audit log entries in /var/log/audit/audit.log showing SYSCALL records for process that changed UID from non-root to root (uid=X euid=0) without a legitimate sudo/su invocation
  • > Unexpected setuid binaries or new entries in /etc/sudoers or /etc/sudoers.d/ created after the exploitation timestamp, indicating persistence mechanisms installed by the attacker
  • > Loaded kernel modules not present in the system's package manager database (dpkg -l | grep linux-modules or rpm -qa | grep kernel) that may represent rootkit persistence

Tuning Guidance

This detection will generate noise on Linux hosts running kernel crash testing frameworks (kdump, kexec), hosts with failing RAM (hardware memory errors produce similar kernel messages), and development systems running kernel debug builds with KASAN/UBSAN enabled. Suppress alerts from hosts tagged as 'kernel-dev' or 'staging-test' in your asset inventory. For high-fidelity tuning, combine kernel fault messages with a correlated privilege escalation event (UID transition to 0) within a 60-second window — this significantly reduces false positives while preserving detection of actual exploitation chains. Additionally, establish a baseline of 'normal' kernel fault rate per host over 14 days and alert only on statistically significant spikes above the host's historical baseline.

Hunting Queries

30-day retrospective hunt for Linux kernel resource transfer fault messages across all monitored Linux hosts to identify potential historical exploitation of CVE-2026-31431 or related kernel copy vulnerabilities that may have preceded the detection rule deployment.

Hunting — KQL
kql 
Syslog
| where TimeGenerated > ago(30d)
| where Facility =~ "kern"
| where SyslogMessage has_any ("copy_to_user", "copy_from_user", "__copy_overflow", "BUG:", "Oops:", "general protection fault")
| summarize EventCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), SampleMessages=make_set(SyslogMessage, 5) by Computer
| where EventCount > 0
| order by LastSeen desc
Hunting — SPL
spl 
index=linux_logs sourcetype=syslog earliest=-30d
| rex field=_raw "kernel: (?<kernel_msg>.+)"
| where match(kernel_msg, "copy_to_user|copy_from_user|__copy_overflow|BUG:|Oops:|general protection fault")
| stats count AS fault_count, earliest(_time) AS first_seen, latest(_time) AS last_seen, values(kernel_msg) AS messages BY host
| sort - last_seen

Atomic Red Team Tests

Test 1 Simulate kernel copy boundary fault via /proc/kcore read attempt
linux

Attempts to read from /proc/kcore as an unprivileged user to trigger kernel memory access boundary enforcement, simulating the class of access that CVE-2026-31431 bypasses. This does not exploit the CVE but generates similar telemetry.

Command

bash 
# Run as non-root user in isolated lab VM
id
dd if=/proc/kcore of=/tmp/kcore_sample bs=4096 count=1 2>&1 || echo 'Expected: permission denied or kernel fault'
dmesg | tail -20

Cleanup

bash 
rm -f /tmp/kcore_sample

Expected Telemetry

Kernel message in dmesg showing access denial or fault; audit log SYSCALL record for 'open' or 'read' on /proc/kcore by non-root UID; possible kernel warning message about unauthorized memory access attempt

Expected Detection

Syslog/kern.log kernel message detected by the query; QRadar/Sentinel alert fires on kernel boundary message pattern

Test 2 Privilege escalation simulation via SUID binary abuse on unpatched kernel
linux

In a controlled lab environment with a known-vulnerable kernel version, uses a crafted SUID binary to test privilege escalation detection telemetry without executing an actual exploit payload. Tests detection of UID transition to root.

Command

bash 
# LAB ONLY — requires unpatched kernel in isolated VM with no network
# Create test SUID binary that logs the UID transition for telemetry testing
cat > /tmp/test_suid.c << 'EOF'
#include <stdio.h>
#include <unistd.h>
int main() { printf("EUID: %d\n", geteuid()); return 0; }
EOF
gcc -o /tmp/test_suid /tmp/test_suid.c
# As root, set SUID bit (simulates post-exploitation artifact)
chmod u+s /tmp/test_suid
# Run as non-root to generate UID-0 execution telemetry
su -c '/tmp/test_suid' testuser 2>/dev/null
# Check audit log for SYSCALL record
ausearch -k suid_exec 2>/dev/null || grep 'test_suid' /var/log/audit/audit.log | tail -5

Cleanup

bash 
rm -f /tmp/test_suid /tmp/test_suid.c; userdel testuser 2>/dev/null || true

Expected Telemetry

Audit log SYSCALL record showing execve of test_suid with uid!=0 but euid=0; EDR process event showing SUID execution; possible AppArmor/SELinux denial log if MAC policy is enforced

Expected Detection

CrowdStrike Falcon PrivilegeEscalationDetected event; SIEM alert on SUID binary execution by non-privileged user context

Test 3 Container escape boundary test via /proc/sysrq-trigger probe
linux

From inside a Docker container on a lab host, probes kernel interface files that should be inaccessible from within the container namespace, generating telemetry for the container escape detection path of CVE-2026-31431.

Command

bash 
# LAB ONLY — run inside Docker container on isolated test host
# Start test container
docker run --rm -it --name cve_2026_31431_test ubuntu:22.04 bash -c '
  echo "Container UID: $(id)"
  # Probe kernel interfaces that should be namespace-isolated
  cat /proc/sysrq-trigger 2>&1 || echo "Blocked as expected"
  ls -la /proc/1/ns/ 2>&1
  cat /proc/1/cmdline 2>/dev/null && echo "WARNING: accessed host PID 1" || echo "PID namespace isolated"
  # Probe /dev/mem (should fail in unprivileged container)
  dd if=/dev/mem bs=1 count=1 2>&1 || echo "dev/mem blocked"
'
# On host: check kernel log for any boundary fault messages
dmesg | tail -30 | grep -E 'namespace|container|cgroup|fault'

Cleanup

bash 
docker rm -f cve_2026_31431_test 2>/dev/null || true

Expected Telemetry

Host kernel log entries showing container namespace probe attempts; Docker daemon log entries for the test container; audit log entries showing file access attempts to /dev/mem or /proc/1/ from container process

Expected Detection

Chronicle YARA-L rule triggers on /proc/*/mem access pattern; Elastic EQL sequence detects file access to kernel interfaces followed by attempted privilege boundary crossing

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0005Defense EvasionTA0003Persistence

Related Techniques

T1068Exploitation for Privilege EscalationT1611Escape to HostT1055Process Injection

Same Tactic: Privilege Escalation

Popular Detections