B&R patches Linux kernel privilege-escalation flaws
B&R Industrial Automation released patches for five Linux kernel vulnerabilities allowing local privilege escalation in APROL, Linux for B&R, and X20EDS410 products.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 5 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-31431 and CVE-2026-46300 as exploited in the wild.
B&R Industrial Automation has disclosed five Linux kernel vulnerabilities (CVE-2026-31431, CVE-2026-43284, CVE-2026-46333, CVE-2026-46300, CVE-2026-43494) affecting its APROL automation software, Linux for B&R distributions version 12 and earlier, and X20EDS410 industrial controllers. All vulnerabilities require local access with low-privileged credentials and enable privilege escalation to root. Public proof-of-concept exploits exist, though B&R reports no evidence of active exploitation targeting its products.
The vulnerabilities span cryptographic handling (algif_aead in-place operations), ESP packet processing, ptrace access controls, shared fragment handling in TCP coalescing, and RDS zerocopy page-pinning logic. B&R has released patched versions (APROL-AutoYaST-DVD-V4.4-010.10.260602 for APROL; Debian repository updates for Linux for B&R) and recommends immediate installation. For systems where updates are not immediately feasible, B&R provides a temporary mitigation: disabling the algif_aead kernel module via modprobe blacklist, which blocks exploitation of CVE-2026-31431 without affecting most cryptographic functions.
The advisory targets critical manufacturing sectors worldwide. B&R emphasizes strict access controls, limiting interactive system access to authorized personnel, and disabling unused accounts as foundational defenses. Customers must conduct risk assessments and test workarounds before production deployment, as B&R has no visibility into custom applications that may depend on affected kernel interfaces.
Mentioned in this report
Detection guidance
Ptrace Syscall Invoked Against Root-Owned Process by Unprivileged User
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a non-root process attaching via ptrace to a process running as root, a pattern consistent with exploitation of Linux kernel ptrace access-control flaws for local privilege escalation (e.g. CVE-2026-46333). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ptrace Syscall Invoked Against Root-Owned Process by Unprivileged User
id: 6dc1a47a-0f56-5771-b9a0-18fd3b24d57b
status: experimental
description: Detects a non-root process attaching via ptrace to a process running
as root, a pattern consistent with exploitation of Linux kernel ptrace access-control
flaws for local privilege escalation (e.g. CVE-2026-46333).
references:
- Vendor advisory on B&R APROL / Linux for B&R kernel privilege-escalation CVEs
logsource:
product: linux
service: auditd
category: null
detection:
selection:
type: SYSCALL
syscall: ptrace
success: 'yes'
filter_root_caller:
uid: 0
condition: selection and not filter_root_caller
fields:
- exe
- uid
- auid
- key
falsepositives:
- Legitimate debuggers (gdb, strace) run by administrators or developers against their
own processes
- Application performance monitoring or crash-handling agents that attach to processes
for diagnostics
level: medium
tags:
- attack.t1068
- attack.privilege-escalation
author: Vorant
Modification of algif_aead Modprobe Blacklist Entry
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects changes to modprobe blacklist configuration removing or altering the algif_aead entry, which could indicate an attacker re-enabling a kernel module that was disabled as a mitigation for CVE-2026-31431 in-place AEAD privilege-escalation exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Modification of algif_aead Modprobe Blacklist Entry
id: c45f4690-1ab5-5976-ab56-4f59b0c14906
status: experimental
description: Detects changes to modprobe blacklist configuration removing or altering
the algif_aead entry, which could indicate an attacker re-enabling a kernel module
that was disabled as a mitigation for CVE-2026-31431 in-place AEAD privilege-escalation
exploitation.
references:
- Vendor advisory on B&R APROL / Linux for B&R kernel privilege-escalation CVEs
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains: /etc/modprobe.d/
TargetFilename|endswith: .conf
keyword_match:
TargetFilename|contains: blacklist
condition: selection and keyword_match
fields:
- TargetFilename
- Image
- User
falsepositives:
- Authorized system administrators updating modprobe blacklist files as part of routine
hardening or rollback
- Configuration management tools (Ansible, Puppet, Chef) applying approved modprobe
policy changes
level: low
tags:
- attack.t1068
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-174-06
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs