Impact of Linux Kernel vulnerabilities on B&R products
Summary
<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-174-06.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>B&R is aware of publicly reported vulnerabilities affecting the Linux kernel versions shipped with the products listed as affected in the advisory. Successful local exploitation of these vulnerabilities could allow an attacker to escalate privileges on the affected system. Public proof-of-concept exploits are available for the vulnerabilities described herein. At the time of publication of this advisory, B&R had no evidence of active exploitation targeting B&R products.</strong></p> <p>The following versions of Impact of Linux Kernel vulnerabilities on B&R products are affected:</p> <ul> <li>Linux for B&R <=12 </li> <li>APROL <APROL-AutoYaST-DVD- V4.4-010.10.260602</li> <li>X20EDS410 /all </li> </ul> <div class="csaf-table"> <table class="tablesaw tablesaw-stack"> <thead> <tr> <th>CVSS</th> <th>Vendor</th> <th>Equipment</th> <th>Vulnerabilities</th> </tr> </thead> <tbody> <tr> <td>v3 7.8</td> <td>B&R Industrial Automation GmbH</td> <td>Impact of Linux Kernel vulnerabilities on B&R products</td> <td>Incorrect Resource Transfer Between Spheres, Write-what-where Condition, Improper Privilege Management, Out-of-bounds Write, Multiple Releases of Same Resource or Handle</td> </tr> </tbody> </table> </div> <h3>Background</h3> <ul> <li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing</li> <li><strong>Countries/Areas Deployed: </strong>Worldwide</li> <li><strong>Company Headquarters Location: </strong>Switzerland</li> </ul> <hr /> <h2>Vulnerabilities</h2> <div class="csaf-accordion"> <p><a class="csaf-accordion-toggle-all" href="https://www.cisa.gov/">Expand All +</a></p> <div class="csaf-accordion-item"> <h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/">CVE-2026-31431</a></h3> <div class="csaf-accordion-content"> <p>In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.</p> <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-31431">View CVE Details</a></p> <hr /> <h4>Affected Products</h4> <h5>Impact of Linux Kernel vulnerabilities on B&R products</h5> <div class="ics-vendor-version-status"> <div class="ics-vendor"><strong>Vendor:</strong><br />B&R Industrial Automation GmbH</div> <div class="ics-version"><strong>Product Version:</strong><br />B&R Industrial Automation GmbH Linux for B&R <=12, B&R Industrial Automation GmbH APROL <APROL-AutoYaST-DVD- V4.4-010.10.260602, B&R Industrial Automation GmbH X20EDS410 /all</div> <div class="ics-status"><strong>Product Status:</strong><br />fixed, known_affected</div> </div> <div class="ics-remediations"> <h6>Remediations</h6> <p><strong>Vendor fix</strong><br />For affected products, software updates should be installed upon availability. Product Patch version - APROL : APROL-AutoYaST-DVD- V4.4-010.10.260602 Until remediated software versions are available, customers are required to conduct a risk assessment of their affected systems and to implement the mitigation measures and workarounds specified in this advisory.</p> <p><strong>Mitigation</strong><br />Successful exploitation of the vulnerabilities described in this advisory requires local access to the affected system with low-privileged user credentials. Customers are strongly advised to enforce strict access control policies on all Linux-based systems, ensuring that interactive access is exclusively granted to authorized and trusted personnel. This includes reviewing and hardening user account permissions and disabling unused accounts. Refer to section “General security recommendations” for further advise on how to keep your system secure.</p> <p><strong>Workaround</strong><br />Security researchers have identified and validated the following workarounds to reduce exposure to the vulnerabilities described in this advisory. These measures do not remediate the underlying vulnerabilities but effectively block known attack vectors until patched software versions are deployed. Important: Customers are advised to thoroughly test their systems after applying any of the listed workarounds. B&R has no visibility into customer-specific applications running on the underlying Linux system. It is the customer's responsibility to assess whether the applied workarounds interfere with existing application workloads prior to deployment in production environments. For Debian-based systems within an active support lifecycle, kernel patches addressing CVE-2026-31431 are already available via the official package repositories. Customers are strongly encouraged to apply these updates immediately by executing the following command: sudo apt update && sudo apt upgrade A system reboot is required after the upgrade for the updated kernel to take effect. Temporary Mitigation: If an immediate system update is not feasible, the affected kernel module (algif_aead) can be disabled persistently. Security researchers have confirmed this measure effectively prevents exploitation of CVE-2026-31431. Execute the following commands as root: echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf rmmod algif_aead 2>/dev/null || true Impact assessment: Disabling the algif_aead module removes the AEAD socket interface from the kernel cryp-to API. This does not affect dm-crypt/LUKS, kTLS, IPsec/XFRM, OpenSSL, GnuTLS, NSS, or SSH. Applications explicitly configured to use the afalg engine or that directly bind aead, skcipher, or hash sockets via AF_ALG may be affected. To assess exposure prior to applying this workaround, run: lsof | grep AF_ALG</p> </div> <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/669.html">CWE-669 Incorrect Resource Transfer Between Spheres</a></p> <hr /> <h4>Metrics</h4> <div class="csaf-table csaf-metrics-table"> <table class="tablesaw tablesaw-stack"> <thead> <tr> <th>CVSS Version</th> <th>Base Score</th> <th>Base Severity</th> <th>Vector String</th> </tr> </thead> <tbody> <tr> <td>3.1</td> <td>7.8</td> <td>HIGH</td> <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RC:C">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RC:C</a></td> </tr> </tbody> </table> </div> </div> </div> <div class="csaf-accordion-item"> <h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/">CVE-2026-43284</a></h3> <div class="csaf-accordion-content"> <p>In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt external-ly backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data().</p> <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-43284">View CVE Details</a></p> <hr /> <h4>Affected Products</h4> <h5>Impact of Linux Kernel vulnerabilities on B&R products</h5> <div class="ics-vendor-version-status"> <div class="ics-vendor"><strong>Vendor:</strong><br />B&R Industrial Automation GmbH</div> <div class="ics-version"><strong>Product Version:</strong><br />B&R Industrial Automation GmbH Linux for B&R <=12, B&R Industrial Automation GmbH APROL <APROL-AutoYaST-DVD- V4.4-010.10.260602, B&R Industrial Automation GmbH X20EDS410 /all</div> <div class="ics-status"><strong>Product Status:</strong><br />fixed, known_affected</div> </div> <div class="ics-remediations"> <h6>Remediations</h6> <p><strong>Vendor fix</strong><br />For affected products, software updates should be installed upon availability. Product Patch version - APROL : APROL-AutoYaST-DVD- V4.4-010.10.260602 Until remediated software versions are available, customers are required to conduct a risk assessment of their affected systems and to implement the mitigation measures and workarounds specified in this advisory.</p> <p><strong>Mitigation</strong><br />Successful exploitation of the vulnerabilities described in this advisory requires local access to the affected system with low-privileged user credentials. Customers are strongly advised to enforce strict access control policies on all Linux-based systems, ensuring that interactive access is exclusively granted to authorized and trusted personnel. This includes reviewing and hardening user account permissions and disabling unused accounts. Refer to section “General security recommendations” for further advise on how to keep your system secure.</p> <p><strong>Workaround</strong><br />Security researchers have identified and validated the following workarounds to reduce exposure to the vulnerabilities described in this advisory. These measures do not remediate the underlying vulnerabilities but effectively block known attack vectors until patched software versions are deployed. Important: Customers are advised to thoroughly test their systems after applying any of the listed workarounds. B&R has no visibility into customer-specific applications running on the underlying Linux system. It is the customer's responsibility to assess whether the applied workarounds interfere with existing application workloads prior to deployment in production environments. For Debian-based systems within an active support lifecycle, kernel patches addressing CVE-2026-31431 are already available via the official package repositories. Customers are strongly encouraged to apply these updates immediately by executing the following command: sudo apt update && sudo apt upgrade A system reboot is required after the upgrade for the updated kernel to take effect. Temporary Mitigation: If an immediate system update is not feasible, the affected kernel module (algif_aead) can be disabled persistently. Security researchers have confirmed this measure effectively prevents exploitation of CVE-2026-31431. Execute the following commands as root: echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf rmmod algif_aead 2>/dev/null || true Impact assessment: Disabling the algif_aead module removes the AEAD socket interface from the kernel cryp-to API. This does not affect dm-crypt/LUKS, kTLS, IPsec/XFRM, OpenSSL, GnuTLS, NSS, or SSH. Applications explicitly configured to use the afalg engine or that directly bind aead, skcipher, or hash sockets via AF_ALG may be affected. To assess exposure prior to applying this workaround, run: lsof | grep AF_ALG</p> </div> <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/123.html">CWE-123 Write-what-where Condition</a></p> <hr /> <h4>Metrics</h4> <div class="csaf-table csaf-metrics-table"> <table class="tablesaw tablesaw-stack"> <thead> <tr> <th>CVSS Version</th> <th>Base Score</th> <th>Base Severity</th> <th>Vector String</th> </tr> </thead> <tbody> <tr> <td>3.1</td> <td>7.8</td> <td>HIGH</td> <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H</a></td> </tr> </tbody> </table> </div> </div> </div> <div class="csaf-accordion-item"> <h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/">CVE-2026-46333</a></h3> <div class="csaf-accordion-content"> <p>In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when you don't have an associated mm. And almost all users do in fact use it only for the case where the task has a mm pointer. But we have one odd special case: ptrace_may_access() uses 'dumpable' to check various other things entirely independently of the MM (typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for threads that no longer have a VM (and maybe never did, like most kernel threads). It's not what this flag was designed for, but it is what it is. The ptrace code does check that the uid/gid matches, so you do have to be uid-0 to see kernel thread details, but this means that the traditional "drop capabilities" model doesn't make any difference for this all. Make it all make a *bit* more sense by saying that if you don't have a MM pointer, we'll use a cached "last dumpability" flag if the thread ever had a MM (it will be zero for kernel threads since it is never set), and require a proper CAP_SYS_PTRACE capability to override.</p> <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-46333">View CVE Details</a></p> <hr /> <h4>Affected Products</h4> <h5>Impact of Linux Kernel vulnerabilities on B&R products</h5> <div class="ics-vendor-version-status"> <div class="ics-vendor"><strong>Vendor:</strong><br />B&R Industrial Automation GmbH</div> <div class="ics-version"><strong>Product Version:</strong><br />B&R Industrial Automation GmbH Linux for B&R <=12, B&R Industrial Automation GmbH APROL <APROL-AutoYaST-DVD- V4.4-010.10.260602, B&R Industrial Automation GmbH X20EDS410 /all</div> <div class="ics-status"><strong>Product Status:</strong><br />fixed, known_affected</div> </div> <div class="ics-remediations"> <h6>Remediations</h6> <p><strong>Vendor fix</strong><br />For affected products, software updates should be installed upon availability. Product Patch version - APROL : APROL-AutoYaST-DVD- V4.4-010.10.260602 Until remediated software versions are available, customers are required to conduct a risk assessment of their affected systems and to implement the mitigation measures and workarounds specified in this advisory.</p> <p><strong>Mitigation</strong><br />Successful exploitation of the vulnerabilities described in this advisory requires local access to the affected system with low-privileged user credentials. Customers are strongly advised to enforce strict access control policies on all Linux-based systems, ensuring that interactive access is exclusively granted to authorized and trusted personnel. This includes reviewing and hardening user account permissions and disabling unused accounts. Refer to section “General security recommendations” for further advise on how to keep your system secure.</p> <p><strong>Workaround</strong><br />Security researchers have identified and validated the following workarounds to reduce exposure to the vulnerabilities described in this advisory. These measures do not remediate the underlying vulnerabilities but effectively block known attack vectors until patched software versions are deployed. Important: Customers are advised to thoroughly test their systems after applying any of the listed workarounds. B&R has no visibility into customer-specific applications running on the underlying Linux system. It is the customer's responsibility to assess whether the applied workarounds interfere with existing application workloads prior to deployment in production environments. For Debian-based systems within an active support lifecycle, kernel patches addressing CVE-2026-31431 are already available via the official package repositories. Customers are strongly encouraged to apply these updates immediately by executing the following command: sudo apt update && sudo apt upgrade A system reboot is required after the upgrade for the updated kernel to take effect. Temporary Mitigation: If an immediate system update is not feasible, the affected kernel module (algif_aead) can be disabled persistently. Security researchers have confirmed this measure effectively prevents exploitation of CVE-2026-31431. Execute the following commands as root: echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf rmmod algif_aead 2>/dev/null || true Impact assessment: Disabling the algif_aead module removes the AEAD socket interface from the kernel cryp-to API. This does not affect dm-crypt/LUKS, kTLS, IPsec/XFRM, OpenSSL, GnuTLS, NSS, or SSH. Applications explicitly configured to use the afalg engine or that directly bind aead, skcipher, or hash sockets via AF_ALG may be affected. To assess exposure prior to applying this workaround, run: lsof | grep AF_ALG</p> </div> <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/269.html">CWE-269 Improper Privilege Management</a></p> <hr /> <h4>Metrics</h4> <div class="csaf-table csaf-metrics-table"> <table class="tablesaw tablesaw-stack"> <thead> <tr> <th>CVSS Version</th> <th>Base Score</th> <th>Base Severity</th> <th>Vector String</th> </tr> </thead> <tbody> <tr> <td>3.1</td> <td>7.1</td> <td>HIGH</td> <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N</a></td> </tr> </tbody> </table> </div> </div> </div> <div class="csaf-accordion-item"> <h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/">CVE-2026-46300</a></h3> <div class="csaf-accordion-content"> <p>In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors..</p> <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-46300">View CVE Details</a></p> <hr /> <h4>Affected Products</h4> <h5>Impact of Linux Kernel vulnerabilities on B&R products</h5> <div class="ics-vendor-version-status"> <div class="ics-vendor"><strong>Vendor:</strong><br />B&R Industrial Automation GmbH</div> <div class="ics-version"><strong>Product Version:</strong><br />B&R Industrial Automation GmbH Linux for B&R <=12, B&R Industrial Automation GmbH APROL <APROL-AutoYaST-DVD- V4.4-010.10.260602, B&R Industrial Automation GmbH X20EDS410 /all</div> <div class="ics-status"><strong>Product Status:</strong><br />fixed, known_affected</div> </div> <div class="ics-remediations"> <h6>Remediations</h6> <p><strong>Vendor fix</strong><br />For affected products, software updates should be installed upon availability. Product Patch version - APROL : APROL-AutoYaST-DVD- V4.4-010.10.260602 Until remediated software versions are available, customers are required to conduct a risk assessment of their affected systems and to implement the mitigation measures and workarounds specified in this advisory.</p> <p><strong>Mitigation</strong><br />Successful exploitation of the vulnerabilities described in this advisory requires local access to the affected system with low-privileged user credentials. Customers are strongly advised to enforce strict access control policies on all Linux-based systems, ensuring that interactive access is exclusively granted to authorized and trusted personnel. This includes reviewing and hardening user account permissions and disabling unused accounts. Refer to section “General security recommendations” for further advise on how to keep your system secure.</p> <p><strong>Workaround</strong><br />Security researchers have identified and validated the following workarounds to reduce exposure to the vulnerabilities described in this advisory. These measures do not remediate the underlying vulnerabilities but effectively block known attack vectors until patched software versions are deployed. Important: Customers are advised to thoroughly test their systems after applying any of the listed workarounds. B&R has no visibility into customer-specific applications running on the underlying Linux system. It is the customer's responsibility to assess whether the applied workarounds interfere with existing application workloads prior to deployment in production environments. For Debian-based systems within an active support lifecycle, kernel patches addressing CVE-2026-31431 are already available via the official package repositories. Customers are strongly encouraged to apply these updates immediately by executing the following command: sudo apt update && sudo apt upgrade A system reboot is required after the upgrade for the updated kernel to take effect. Temporary Mitigation: If an immediate system update is not feasible, the affected kernel module (algif_aead) can be disabled persistently. Security researchers have confirmed this measure effectively prevents exploitation of CVE-2026-31431. Execute the following commands as root: echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf rmmod algif_aead 2>/dev/null || true Impact assessment: Disabling the algif_aead module removes the AEAD socket interface from the kernel cryp-to API. This does not affect dm-crypt/LUKS, kTLS, IPsec/XFRM, OpenSSL, GnuTLS, NSS, or SSH. Applications explicitly configured to use the afalg engine or that directly bind aead, skcipher, or hash sockets via AF_ALG may be affected. To assess exposure prior to applying this workaround, run: lsof | grep AF_ALG</p> </div> <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/787.html">CWE-787 Out-of-bounds Write</a></p> <hr /> <h4>Metrics</h4> <div class="csaf-table csaf-metrics-table"> <table class="tablesaw tablesaw-stack"> <thead> <tr> <th>CVSS Version</th> <th>Base Score</th> <th>Base Severity</th> <th>Vector String</th> </tr> </thead> <tbody> <tr> <td>3.1</td> <td>7.8</td> <td>HIGH</td> <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</a></td> </tr> </tbody> </table> </div> </div> </div> <div class="csaf-accordion-item"> <h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/">CVE-2026-43494</a></h3> <div class="csaf-accordion-content"> <p>In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents. Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again. Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user().</p> <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-43494">View CVE Details</a></p> <hr /> <h4>Affected Products</h4> <h5>Impact of Linux Kernel vulnerabilities on B&R products</h5> <div class="ics-vendor-version-status"> <div class="ics-vendor"><strong>Vendor:</strong><br />B&R Industrial Automation GmbH</div> <div class="ics-version"><strong>Product Version:</strong><br />B&R Industrial Automation GmbH Linux for B&R <=12, B&R Industrial Automation GmbH APROL <APROL-AutoYaST-DVD- V4.4-010.10.260602, B&R Industrial Automation GmbH X20EDS410 /all</div> <div class="ics-status"><strong>Product Status:</strong><br />fixed, known_affected</div> </div> <div class="ics-remediations"> <h6>Remediations</h6> <p><strong>Vendor fix</strong><br />For affected products, software updates should be installed upon availability. Product Patch version - APROL : APROL-AutoYaST-DVD- V4.4-010.10.260602 Until remediated software versions are available, customers are required to conduct a risk assessment of their affected systems and to implement the mitigation measures and workarounds specified in this advisory.</p> <p><strong>Mitigation</strong><br />Successful exploitation of the vulnerabilities described in this advisory requires local access to the affected system with low-privileged user credentials. Customers are strongly advised to enforce strict access control policies on all Linux-based systems, ensuring that interactive access is exclusively granted to authorized and trusted personnel. This includes reviewing and hardening user account permissions and disabling unused accounts. Refer to section “General security recommendations” for further advise on how to keep your system secure.</p> <p><strong>Workaround</strong><br />Security researchers have identified and validated the following workarounds to reduce exposure to the vulnerabilities described in this advisory. These measures do not remediate the underlying vulnerabilities but effectively block known attack vectors until patched software versions are deployed. Important: Customers are advised to thoroughly test their systems after applying any of the listed workarounds. B&R has no visibility into customer-specific applications running on the underlying Linux system. It is the customer's responsibility to assess whether the applied workarounds interfere with existing application workloads prior to deployment in production environments. For Debian-based systems within an active support lifecycle, kernel patches addressing CVE-2026-31431 are already available via the official package repositories. Customers are strongly encouraged to apply these updates immediately by executing the following command: sudo apt update && sudo apt upgrade A system reboot is required after the upgrade for the updated kernel to take effect. Temporary Mitigation: If an immediate system update is not feasible, the affected kernel module (algif_aead) can be disabled persistently. Security researchers have confirmed this measure effectively prevents exploitation of CVE-2026-31431. Execute the following commands as root: echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf rmmod algif_aead 2>/dev/null || true Impact assessment: Disabling the algif_aead module removes the AEAD socket interface from the kernel cryp-to API. This does not affect dm-crypt/LUKS, kTLS, IPsec/XFRM, OpenSSL, GnuTLS, NSS, or SSH. Applications explicitly configured to use the afalg engine or that directly bind aead, skcipher, or hash sockets via AF_ALG may be affected. To assess exposure prior to applying this workaround, run: lsof | grep AF_ALG</p> </div> <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/1341.html">CWE-1341 Multiple Releases of Same Resource or Handle</a></p> <hr /> <h4>Metrics</h4> <div class="csaf-table csaf-metrics-table"> <table class="tablesaw tablesaw-stack"> <thead> <tr> <th>CVSS Version</th> <th>Base Score</th> <th>Base Severity</th> <th>Vector String</th> </tr> </thead> <tbody> <tr> <td>3.1</td> <td>7.8</td> <td>HIGH</td> <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</a></td> </tr> </tbody> </table> </div> </div> </div> </div> <hr /> <h2>Acknowledgments</h2> <ul> <li>ABB PSIRT reported these vulnerabilities to CISA.</li> </ul> <hr /> <h2>Notice</h2> <p>The information in this document is subject to change without notice, and should not be construed as a commitment by B&R. B&R provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall B&R or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if B&R or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from B&R, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.</p> <hr /> <h2>Frequently asked questions</h2> <p>What causes the vulnerabilities? - The vulnerabilities are caused by a vulnerable Linux Kernel component. What might an attacker use the vulnerability to do? - An authenticated attacker with low privileges may elevate privileges to root. Could the vulnerabilities be exploited remotely? - Yes, an attacker with privileges to login in a vulnerable system node could exploit these vulnerabilities. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed. When this security advisory was issued, had B&R received any reports that these vulnerabilities were being exploited? - B&R is aware of reports indicating that these vulnerabilities had been exploited at the time this security advisory was originally issued; however, no exploitation has been observed in B&R products.</p> <hr /> <h2>Legal Notice and Terms of Use</h2> <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).</p> <hr /> <h2>Recommended Practices</h2> <p>CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.</p> <p>Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.</p> <p>Locate control system networks and remote devices behind firewalls and isolate them from business networks.</p> <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.</p> <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p> <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p> <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p> <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p> <hr /> <h2>Advisory Conversion Disclaimer</h2> <p>This ICSA is a verbatim republication of ABB PSIRT SA26P010 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact ABB PSIRT directly for any questions regarding this advisory.</p> <h2>Revision History</h2> <ul> <li><strong>Initial Release Date: </strong>2026-06-11</li> </ul> <table class="tablesaw tablesaw-stack"> <thead> <tr> <th>Date</th> <th>Revision</th> <th>Summary</th> </tr> </thead> <tbody> <tr> <td>2026-06-11</td> <td>1</td> <td>Initial version.</td> </tr> <tr> <td>2026-06-18</td> <td>2</td> <td>Updating the CWE classification for CVE-2026-43494.</td> </tr> <tr> <td>2026-06-23</td> <td>3</td> <td>Initial CISA Republication of ABB PSIRT SA26P010 advisory</td> </tr> </tbody> </table> <hr /> <h2>Legal Notice and Terms of Use</h2>