# ABB Edgenius hit by Linux kernel privilege-escalation flaw

Published: 2026-07-14 · Severity: medium · Sectors: manufacturing, energy
Canonical: https://vorant.io/reports/bc29563f-aeeb-586f-a442-95e00b92f4b8/abb-edgenius-hit-by-linux-kernel-privilege-escalation-flaw

> A Linux kernel crypto-subsystem bug (CVE-2026-31431) lets a local user or compromised container gain root on ABB Ability Edgenius edge computing platforms.

ABB has issued an advisory, republished by CISA, disclosing CVE-2026-31431 ('Copy Fail'), a Linux kernel vulnerability affecting the algif_aead cryptographic algorithm interface. An incorrect in-place operation causes source and destination data mappings to diverge, leading to memory handling errors that a locally authenticated user or compromised container workload could exploit to escalate privileges to root. The flaw originates in the kernel's cryptographic subsystem and affects kernels used by most major Linux distributions released since 2017, making it a broadly applicable issue beyond ABB's product line specifically.

Affected products are ABB Ability Edgenius versions >=3.2.0.0 and <3.2.4.1, deployed on Edgenius Gateway bE100, Gateway E3100C, and Server vE1000 hardware. Edgenius is an edge computing platform used to connect to industrial control systems, collect operational data, and host applications delivering real-time insights, placing it within critical manufacturing and broader industrial environments worldwide. Exploitation requires local access—either physical or via valid SSH credentials—so remote exploitation is not possible, and ABB has not received reports of in-the-wild exploitation against Edgenius specifically, though the underlying kernel vulnerability has been publicly disclosed.

ABB has released Edgenius 3.2.4.1 to resolve the issue by incorporating the corresponding Linux kernel security update. Recommended mitigations include limiting access to SSH and Cockpit interfaces, and noting that Edgenius installations do not include additional lower-privilege users by default. CISA reiterates standard ICS hardening guidance, including network segmentation, firewalling control system networks from business networks, and using secure VPNs for any required remote access.

## Mentioned in this report

- Vulnerabilities: CVE-2026-31431 (KEV)

## Detection guidance (public sample)

### Linux AF_ALG Socket Creation by Non-Cryptographic Process

ATT&CK: T1068

Detects a process opening an AF_ALG (kernel crypto API) socket, the interface exploited by CVE-2026-31431 in algif_aead; legitimate use is limited to a small set of known crypto/disk-encryption utilities, so use by other binaries is anomalous and may indicate exploitation of the kernel crypto subsystem for privilege escalation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Linux AF_ALG Socket Creation by Non-Cryptographic Process
description: Detects socket() syscalls requesting the AF_ALG (kernel crypto API, domain
  38/0x26) address family from processes that are not among the small set of known
  crypto/disk-encryption tools. AF_ALG is the interface exploited by CVE-2026-31431
  (algif_aead in-place operation flaw) to trigger kernel memory corruption for local
  privilege escalation. Generalises on the syscall/domain pattern rather than any
  campaign-specific binary or path.
tags:
- attack.privilege_escalation
- attack.t1068
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: SYSCALL
    syscall: socket
    a0: '26'
  filter_known_crypto_tools:
    exe|endswith:
    - /cryptsetup
    - /dmsetup
    - /systemd-cryptsetup
    - /veritysetup
    - /cryptsetup-reencrypt
  condition: selection and not filter_known_crypto_tools
falsepositives:
- Disk encryption tooling (cryptsetup/dmsetup) legitimately using AF_ALG for bulk
  crypto operations
- Custom in-house applications that intentionally use the kernel crypto API via libkcapi
level: medium
id: b805c1c2-7e85-579a-aa8d-010940d5279c
status: experimental
author: Vorant
```

### Root Privilege Attained in SSH Session Without Sudo or Su

ATT&CK: T1068

Detects a process executing with effective UID 0 within an SSH-originated login session where the immediate lineage shows no su/sudo/pkexec invocation, consistent with local kernel exploitation (e.g. CVE-2026-31431) used to escalate a valid SSH user directly to root rather than through an authorised privilege-elevation path. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Root Privilege Attained in SSH Session Without Sudo or Su
description: Flags processes running as UID 0 whose session was authenticated via
  SSH (login UID/session tied to sshd) but whose parent process chain does not include
  a standard privilege-elevation tool (sudo, su, pkexec, doas). This pattern is consistent
  with exploitation of a local kernel vulnerability (such as CVE-2026-31431 in algif_aead)
  to jump directly from an unprivileged SSH session to root, bypassing normal elevation
  mechanisms. Not a proof of exploitation on its own - intended to surface anomalous
  root transitions for investigation.
tags:
- attack.privilege_escalation
- attack.t1068
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: SYSCALL
    uid: '0'
  filter_login_root:
    auid: '0'
  filter_known_elevation:
    ParentImage|endswith:
    - /sudo
    - /su
    - /pkexec
    - /doas
    - /sshd
  condition: selection and not (filter_login_root or filter_known_elevation)
falsepositives:
- Automated root cron/systemd jobs whose auditd records are misattributed to an SSH
  login session
- Custom PAM or session-management tooling that legitimately elevates without invoking
  sudo/su directly
level: medium
id: 77885d95-345f-5a6c-8974-61f95c6690fa
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-195-02

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/bc29563f-aeeb-586f-a442-95e00b92f4b8/abb-edgenius-hit-by-linux-kernel-privilege-escalation-flaw.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup