CVE-2026-31739: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31739 is a Linux kernel vulnerability in the Tegra crypto driver caused by a missing CRYPTO_ALG_ASYNC flag on asynchronous cryptographic algorithms. Because the flag is absent, the kernel's crypto API incorrectly selects these asynchronous implementations when a caller requests only synchronous algorithms, resulting in system crashes. The vulnerability was published on May 1, 2026, and affects Linux kernel versions 6.10 through 6.12.81 (exclusive), 6.13 through 6.18.22 (exclusive), 6.19 through 6.19.12 (exclusive), and 7.0-rc1 through 7.0-rc6. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-166 (Improper Handling of Missing Special Element) and CWE-617 (Reachable Assertion). The Tegra crypto driver (drivers/crypto/tegra/) registers asynchronous algorithms without setting the CRYPTO_ALG_ASYNC flag, which is required by the Linux crypto API to distinguish synchronous from asynchronous implementations. When a kernel subsystem or user-space process requests a synchronous algorithm, the API may resolve the request to the Tegra asynchronous implementation, triggering an assertion failure or kernel crash. The fix adds the missing flag and removes redundant CRYPTO_ALG_TYPE_* flags that are overridden by the registration function regardless (GitHub Advisory).

Successful exploitation results in a kernel crash (denial of service), making the affected system unavailable. An authenticated user with the ability to invoke cryptographic operations through the kernel's crypto API on a Tegra-based system can trigger this condition. There is no evidence of confidentiality or integrity impact beyond the crash itself, despite the CVSS score reflecting high ratings in those categories based on the network-accessible vector (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access to a system running a vulnerable kernel on Tegra hardware and the ability to invoke cryptographic operations.

Apply the available kernel patches: update to Linux kernel 6.12.81 or later (6.12 series), 6.18.22 or later (6.18 series), 6.19.12 or later (6.19 series), or the 7.0 stable release. Upstream fixes are available at the following kernel.org commits: 3aea268b6d5c, 429d05565eb1, 4b56770d3455, and bdbf027a4504 (GitHub Advisory). As a workaround, disabling the Tegra crypto driver (if not required for system functionality) will prevent the vulnerable code path from being reached (Red Hat Bugzilla).