ABB Edgenius hit by Linux kernel privilege-escalation flaw
A Linux kernel crypto-subsystem bug (CVE-2026-31431) lets a local user or compromised container gain root on ABB Ability Edgenius edge computing platforms.
ABB has issued an advisory, republished by CISA, disclosing CVE-2026-31431 ('Copy Fail'), a Linux kernel vulnerability affecting the algif_aead cryptographic algorithm interface. An incorrect in-place operation causes source and destination data mappings to diverge, leading to memory handling errors that a locally authenticated user or compromised container workload could exploit to escalate privileges to root. The flaw originates in the kernel's cryptographic subsystem and affects kernels used by most major Linux distributions released since 2017, making it a broadly applicable issue beyond ABB's product line specifically.
Affected products are ABB Ability Edgenius versions >=3.2.0.0 and <3.2.4.1, deployed on Edgenius Gateway bE100, Gateway E3100C, and Server vE1000 hardware. Edgenius is an edge computing platform used to connect to industrial control systems, collect operational data, and host applications delivering real-time insights, placing it within critical manufacturing and broader industrial environments worldwide. Exploitation requires local access—either physical or via valid SSH credentials—so remote exploitation is not possible, and ABB has not received reports of in-the-wild exploitation against Edgenius specifically, though the underlying kernel vulnerability has been publicly disclosed.
ABB has released Edgenius 3.2.4.1 to resolve the issue by incorporating the corresponding Linux kernel security update. Recommended mitigations include limiting access to SSH and Cockpit interfaces, and noting that Edgenius installations do not include additional lower-privilege users by default. CISA reiterates standard ICS hardening guidance, including network segmentation, firewalling control system networks from business networks, and using secure VPNs for any required remote access.
Mentioned in this report
Detection guidance
Linux AF_ALG Socket Creation by Non-Cryptographic Process
Detects a process opening an AF_ALG (kernel crypto API) socket, the interface exploited by CVE-2026-31431 in algif_aead; legitimate use is limited to a small set of known crypto/disk-encryption utilities, so use by other binaries is anomalous and may indicate exploitation of the kernel crypto subsystem for privilege escalation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Linux AF_ALG Socket Creation by Non-Cryptographic Process
description: Detects socket() syscalls requesting the AF_ALG (kernel crypto API, domain
38/0x26) address family from processes that are not among the small set of known
crypto/disk-encryption tools. AF_ALG is the interface exploited by CVE-2026-31431
(algif_aead in-place operation flaw) to trigger kernel memory corruption for local
privilege escalation. Generalises on the syscall/domain pattern rather than any
campaign-specific binary or path.
tags:
- attack.privilege_escalation
- attack.t1068
logsource:
product: linux
service: auditd
detection:
selection:
type: SYSCALL
syscall: socket
a0: '26'
filter_known_crypto_tools:
exe|endswith:
- /cryptsetup
- /dmsetup
- /systemd-cryptsetup
- /veritysetup
- /cryptsetup-reencrypt
condition: selection and not filter_known_crypto_tools
falsepositives:
- Disk encryption tooling (cryptsetup/dmsetup) legitimately using AF_ALG for bulk
crypto operations
- Custom in-house applications that intentionally use the kernel crypto API via libkcapi
level: medium
id: b805c1c2-7e85-579a-aa8d-010940d5279c
status: experimental
author: Vorant
Root Privilege Attained in SSH Session Without Sudo or Su
Detects a process executing with effective UID 0 within an SSH-originated login session where the immediate lineage shows no su/sudo/pkexec invocation, consistent with local kernel exploitation (e.g. CVE-2026-31431) used to escalate a valid SSH user directly to root rather than through an authorised privilege-elevation path. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Root Privilege Attained in SSH Session Without Sudo or Su
description: Flags processes running as UID 0 whose session was authenticated via
SSH (login UID/session tied to sshd) but whose parent process chain does not include
a standard privilege-elevation tool (sudo, su, pkexec, doas). This pattern is consistent
with exploitation of a local kernel vulnerability (such as CVE-2026-31431 in algif_aead)
to jump directly from an unprivileged SSH session to root, bypassing normal elevation
mechanisms. Not a proof of exploitation on its own - intended to surface anomalous
root transitions for investigation.
tags:
- attack.privilege_escalation
- attack.t1068
logsource:
product: linux
service: auditd
detection:
selection:
type: SYSCALL
uid: '0'
filter_login_root:
auid: '0'
filter_known_elevation:
ParentImage|endswith:
- /sudo
- /su
- /pkexec
- /doas
- /sshd
condition: selection and not (filter_login_root or filter_known_elevation)
falsepositives:
- Automated root cron/systemd jobs whose auditd records are misattributed to an SSH
login session
- Custom PAM or session-management tooling that legitimately elevates without invoking
sudo/su directly
level: medium
id: 77885d95-345f-5a6c-8974-61f95c6690fa
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-195-02
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free