Vulnerability in Linux

CVE-2026-31739

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Add missing CRYPTO_ALG_ASYNC The tegra crypto driver failed to set the CRYPTO_ALG_ASYNC on its asynchronous algorithms, causing the crypto API to select them for users that request only synchronous algorithms. This causes crashes (at least). Fix this by adding the flag like what the other drivers do. Also remove the unnecessary CRYPTO_ALG_TYPE_* flags, since those just get ignored and overridden by the registration function anyway.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.006 (46.6th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 47th percentile — 46.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-31739: held from 0.004 to 0.006.

EPSS over last 30 days · oldest: 0.004 · newest: 0.006 · change: +0.002

Affected products

  • Linux — versions 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0, 6.10, 0
  • Linux Kernel — versions 7.0

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-31739?
CVE-2026-31739 is a high-severity vulnerability in Linux, classified under Reachable Assertion. CVSS score: 8.8/10. Published 2026-05-01.
How severe is CVE-2026-31739?
High severity. CVSS v3 base score is 8.8 out of 10.