ABB Edgenius patches Linux kernel privilege escalation flaw

A Linux kernel crypto subsystem flaw (CVE-2026-31431) lets a local user or compromised container escalate to root on ABB Ability Edgenius edge devices; a fix is available.

ABB has disclosed CVE-2026-31431, a Linux kernel vulnerability in the algif_aead cryptographic algorithm interface affecting ABB Ability Edgenius, an edge computing platform used to connect control systems and host operational data applications in critical manufacturing, energy, water/wastewater, and chemical sectors worldwide. The flaw stems from an incorrect in-place operation where source and destination data mappings differ, leading to memory handling issues that a locally authenticated user or compromised container workload can exploit to escalate privileges to root, gaining complete control of the affected system node.

Exploitation requires local access—either physical access or valid SSH/Cockpit credentials—and cannot be performed remotely. The risk is elevated in shared, containerized, or multi-tenant environments where an attacker may already have limited local access. ABB Ability Edgenius versions >=3.2.0.0 and <3.2.4.1 running on Edgenius Gateway - bE100 are affected; version 3.2.4.1 resolves the issue by incorporating the upstream Linux kernel security fix. The vulnerability affects Linux kernels used by most major distributions released since 2017, making it broadly relevant beyond this specific product.

The vulnerability has been publicly disclosed but ABB has not received reports of active exploitation against Edgenius at the time of publication. Recommended mitigations include applying the vendor update at earliest convenience, limiting access to SSH or Cockpit interfaces, minimizing network exposure of control system devices, isolating ICS networks behind firewalls, and using VPNs for any required remote access. By default, Edgenius installations do not include additional lower-privilege users, which somewhat limits the local attack surface.

title: Local Privilege Escalation via Linux Kernel Exploit
description: Detects process execution with privilege escalation to root (UID 0) following
  local user activity, indicative of kernel exploit abuse. Targets the post-exploitation
  state where a limited user gains root access.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    uid: 0
    user:
    - null
    - ''
    CommandLine|contains:
    - sudo
    - su
  filter_legitimate_root:
    Image|endswith:
    - /systemd
    - /kernel
    - /init
  filter_system_services:
    ParentImage|endswith:
    - /systemd
    - /systemd-logind
    - /sshd
  condition: selection and not filter_legitimate_root and not filter_system_services
falsepositives:
- Legitimate administrative tasks using sudo or su in containers
- Systemd service initialization with elevated privileges
level: high
id: 8abf7bdb-032c-5b42-99c2-67861646843b
status: experimental
author: Vorant

title: Suspicious SSH or Cockpit Access Followed by Privilege Escalation
description: Detects valid SSH or Cockpit authentication succeeded by process execution
  attempting kernel exploitation or privilege escalation to root. Identifies compromised
  valid accounts being leveraged for privilege escalation.
tags:
- attack.t1078
- attack.privilege-escalation
logsource:
  category: authentication
  product: linux
detection:
  selection_ssh_auth:
    EventID: 4624
    LogonType: 10
    Status: '0x0'
  selection_cockpit_auth:
    Service: cockpit
    EventID: 4624
    Status: '0x0'
  selection_escalation:
    CommandLine|contains:
    - 'insmod '
    - 'modprobe '
    - dmesg
    uid:
    - '1000'
    - '1001'
    - '1002'
  condition: (selection_ssh_auth or selection_cockpit_auth) and selection_escalation
falsepositives:
- Legitimate system administrators performing kernel maintenance via SSH
- Scheduled system updates loading kernel modules
level: medium
id: 32b81962-6f9c-5a5e-beea-f92a54490849
status: experimental
author: Vorant

title: Container Workload Kernel Privilege Escalation Attempt
description: Detects container process spawning or executing commands indicative of
  kernel-based privilege escalation (e.g., direct UID 0 process creation, kernel module
  loading from container). Identifies escape attempts from limited container context.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection_container:
    Container_ID|exists: true
  selection_escalation:
    CommandLine|contains:
    - insmod
    - modprobe
    - ioctl
    - /dev/mem
    uid:
    - '0'
  selection_root_spawn:
    uid: '0'
    ParentUid:
    - '1000'
    - '1001'
    - '1002'
  condition: selection_container and (selection_escalation or selection_root_spawn)
falsepositives:
- Privileged containers running legitimate kernel maintenance (e.g., device drivers)
- Container orchestration platforms managing kernel modules as part of normal operation
level: high
id: 9ba5f769-078d-5901-b2dc-cfec0c24425c
status: experimental
author: Vorant

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-06