ABB Edgenius hit by Linux kernel privilege-escalation flaw
A Linux kernel crypto-subsystem bug (CVE-2026-31431) lets a local user or compromised container gain root on ABB Ability Edgenius edge computing platforms.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-31431 as exploited in the wild.
ABB has issued an advisory, republished by CISA, disclosing CVE-2026-31431 ('Copy Fail'), a Linux kernel vulnerability affecting the algif_aead cryptographic algorithm interface. An incorrect in-place operation causes source and destination data mappings to diverge, leading to memory handling errors that a locally authenticated user or compromised container workload could exploit to escalate privileges to root. The flaw originates in the kernel's cryptographic subsystem and affects kernels used by most major Linux distributions released since 2017, making it a broadly applicable issue beyond ABB's product line specifically.
Affected products are ABB Ability Edgenius versions >=3.2.0.0 and <3.2.4.1, deployed on Edgenius Gateway bE100, Gateway E3100C, and Server vE1000 hardware. Edgenius is an edge computing platform used to connect to industrial control systems, collect operational data, and host applications delivering real-time insights, placing it within critical manufacturing and broader industrial environments worldwide. Exploitation requires local access—either physical or via valid SSH credentials—so remote exploitation is not possible, and ABB has not received reports of in-the-wild exploitation against Edgenius specifically, though the underlying kernel vulnerability has been publicly disclosed.
ABB has released Edgenius 3.2.4.1 to resolve the issue by incorporating the corresponding Linux kernel security update. Recommended mitigations include limiting access to SSH and Cockpit interfaces, and noting that Edgenius installations do not include additional lower-privilege users by default. CISA reiterates standard ICS hardening guidance, including network segmentation, firewalling control system networks from business networks, and using secure VPNs for any required remote access.
Mentioned in this report
Detection guidance
Linux AF_ALG Socket Creation by Non-Cryptographic Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a process opening an AF_ALG (kernel crypto API) socket, the interface exploited by CVE-2026-31431 in algif_aead; legitimate use is limited to a small set of known crypto/disk-encryption utilities, so use by other binaries is anomalous and may indicate exploitation of the kernel crypto subsystem for privilege escalation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Linux AF_ALG Socket Creation by Non-Cryptographic Process
description: Detects socket() syscalls requesting the AF_ALG (kernel crypto API, domain
38/0x26) address family from processes that are not among the small set of known
crypto/disk-encryption tools. AF_ALG is the interface exploited by CVE-2026-31431
(algif_aead in-place operation flaw) to trigger kernel memory corruption for local
privilege escalation. Generalises on the syscall/domain pattern rather than any
campaign-specific binary or path.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
product: linux
service: auditd
detection:
selection:
type: SYSCALL
syscall: socket
a0: '26'
filter_known_crypto_tools:
exe|endswith:
- /cryptsetup
- /dmsetup
- /systemd-cryptsetup
- /veritysetup
- /cryptsetup-reencrypt
condition: selection and not filter_known_crypto_tools
falsepositives:
- Disk encryption tooling (cryptsetup/dmsetup) legitimately using AF_ALG for bulk
crypto operations
- Custom in-house applications that intentionally use the kernel crypto API via libkcapi
level: medium
id: b805c1c2-7e85-579a-aa8d-010940d5279c
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-195-02
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs