# B&R patches Linux kernel privilege-escalation flaws

Published: 2026-06-23 · Severity: medium · Sectors: manufacturing
Canonical: https://vorant.io/reports/1f604dab-e678-5107-a0f6-2303edd3cd12/b-r-patches-linux-kernel-privilege-escalation-flaws

> B&R Industrial Automation released patches for five Linux kernel vulnerabilities allowing local privilege escalation in APROL, Linux for B&R, and X20EDS410 products.

B&R Industrial Automation has disclosed five Linux kernel vulnerabilities (CVE-2026-31431, CVE-2026-43284, CVE-2026-46333, CVE-2026-46300, CVE-2026-43494) affecting its APROL automation software, Linux for B&R distributions version 12 and earlier, and X20EDS410 industrial controllers. All vulnerabilities require local access with low-privileged credentials and enable privilege escalation to root. Public proof-of-concept exploits exist, though B&R reports no evidence of active exploitation targeting its products.

The vulnerabilities span cryptographic handling (algif_aead in-place operations), ESP packet processing, ptrace access controls, shared fragment handling in TCP coalescing, and RDS zerocopy page-pinning logic. B&R has released patched versions (APROL-AutoYaST-DVD-V4.4-010.10.260602 for APROL; Debian repository updates for Linux for B&R) and recommends immediate installation. For systems where updates are not immediately feasible, B&R provides a temporary mitigation: disabling the algif_aead kernel module via modprobe blacklist, which blocks exploitation of CVE-2026-31431 without affecting most cryptographic functions.

The advisory targets critical manufacturing sectors worldwide. B&R emphasizes strict access controls, limiting interactive system access to authorized personnel, and disabling unused accounts as foundational defenses. Customers must conduct risk assessments and test workarounds before production deployment, as B&R has no visibility into custom applications that may depend on affected kernel interfaces.

## Mentioned in this report

- Vulnerabilities: CVE-2026-31431 (KEV), CVE-2026-43284 (weaponized), CVE-2026-43494, CVE-2026-46300 (poc), CVE-2026-46333 (weaponized)

## Detection guidance (public sample)

### Ptrace Syscall Invoked Against Root-Owned Process by Unprivileged User

ATT&CK: T1068

Detects a non-root process attaching via ptrace to a process running as root, a pattern consistent with exploitation of Linux kernel ptrace access-control flaws for local privilege escalation (e.g. CVE-2026-46333). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Ptrace Syscall Invoked Against Root-Owned Process by Unprivileged User
id: 6dc1a47a-0f56-5771-b9a0-18fd3b24d57b
status: experimental
description: Detects a non-root process attaching via ptrace to a process running
  as root, a pattern consistent with exploitation of Linux kernel ptrace access-control
  flaws for local privilege escalation (e.g. CVE-2026-46333).
references:
- Vendor advisory on B&R APROL / Linux for B&R kernel privilege-escalation CVEs
logsource:
  product: linux
  service: auditd
category: null
detection:
  selection:
    type: SYSCALL
    syscall: ptrace
    success: 'yes'
  filter_root_caller:
    uid: 0
  condition: selection and not filter_root_caller
fields:
- exe
- uid
- auid
- key
falsepositives:
- Legitimate debuggers (gdb, strace) run by administrators or developers against their
  own processes
- Application performance monitoring or crash-handling agents that attach to processes
  for diagnostics
level: medium
tags:
- attack.t1068
- attack.privilege_escalation
author: Vorant
```

### Modification of algif_aead Modprobe Blacklist Entry

ATT&CK: T1068

Detects changes to modprobe blacklist configuration removing or altering the algif_aead entry, which could indicate an attacker re-enabling a kernel module that was disabled as a mitigation for CVE-2026-31431 in-place AEAD privilege-escalation exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Modification of algif_aead Modprobe Blacklist Entry
id: c45f4690-1ab5-5976-ab56-4f59b0c14906
status: experimental
description: Detects changes to modprobe blacklist configuration removing or altering
  the algif_aead entry, which could indicate an attacker re-enabling a kernel module
  that was disabled as a mitigation for CVE-2026-31431 in-place AEAD privilege-escalation
  exploitation.
references:
- Vendor advisory on B&R APROL / Linux for B&R kernel privilege-escalation CVEs
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains: /etc/modprobe.d/
    TargetFilename|endswith: .conf
  keyword_match:
    TargetFilename|contains: blacklist
  condition: selection and keyword_match
fields:
- TargetFilename
- Image
- User
falsepositives:
- Authorized system administrators updating modprobe blacklist files as part of routine
  hardening or rollback
- Configuration management tools (Ansible, Puppet, Chef) applying approved modprobe
  policy changes
level: low
tags:
- attack.t1068
- attack.defense_evasion
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-174-06

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1f604dab-e678-5107-a0f6-2303edd3cd12/b-r-patches-linux-kernel-privilege-escalation-flaws.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup