Situation

A vulnerability CVE-2026-31431 affecting Linux Kernels has been discovered within the algif_aead optimization added in 2017. This is not tied to a specific distribution and affects most major distributions. This affects the underlying operating system kernel, not cPanel itself.

Impact

For Kernels since 2017 (starting around version 4.14) that contain an optimization for the AF_ALG crypto API. It is possible for a local user to obtain root-level access to a Linux server by modifying the page cache that the kernel reads when loading a binary. This is a logical bug that allows users to gain unauthorized root access to a Linux server without relying on a race condition.

• AlmaLinux
• CloudLinux
• Red Hat Linux
• Ubuntu

Call to Action

For servers with KernelCare

If KernelCare is installed, you can patch the running kernel without a reboot. Run the following command to apply the latest livepatch:

kcarectl --update

Then verify that CVE-2026-31431 is covered by the applied patch:

kcarectl --patch-info | grep CVE-2026-31431

If both of the following are true, this indicates that KernelCare does not currently cover CVE-2026-31431 for the running kernel:

• kcarectl --update returns: There are no updates for this kernel yet
• kcarectl --patch-info | grep CVE-2026-31431 produces no output

In this case, proceed to the OS-specific instructions below.

For servers without KernelCare

After the kernel update, reboot the server to ensure the new kernel is loaded. 

 reboot

After a reboot, verify the kernel is updated to the versions from the list above.

 uname -r

If you are unable to update due to a patch not being available, we recommend performing the following steps to mitigate this. This will ensure the module is not loaded by the kernel on boot:

Add the module to the blacklist using grubby as below:

 grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"

Then reboot the server so the module is loaded

 sudo reboot

Removing the patch would be done with a remove-args command with grubby:

 grubby --update-kernel=ALL --remove-args="initcall_blacklist=algif_aead_init"

then another reboot so the new arguments are loaded:

 sudo reboot