{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-31739",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2026-03-09T15:48:24.138Z",
        "datePublished": "2026-05-01T14:14:35.551Z",
        "dateUpdated": "2026-08-05T12:24:55.007Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T12:24:55.007Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: tegra - Add missing CRYPTO_ALG_ASYNC\n\nThe tegra crypto driver failed to set the CRYPTO_ALG_ASYNC on its\nasynchronous algorithms, causing the crypto API to select them for users\nthat request only synchronous algorithms.  This causes crashes (at\nleast).  Fix this by adding the flag like what the other drivers do.\nAlso remove the unnecessary CRYPTO_ALG_TYPE_* flags, since those just\nget ignored and overridden by the registration function anyway."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 8.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:N - The vulnerable Tegra async hash/HMAC algorithms can be reached through network-facing SUNRPC/RPCSEC_GSS/NFS paths that request synchronous HMAC algorithms and then process attacker-supplied RPC messages.\nAC:L - Once the affected Tegra crypto driver is registered and a vulnerable network service uses RPCSEC_GSS, the attacker can trigger the bad async completion path with ordinary protocol messages; no race or hard-to-control condition is required.\nPR:L - The strongest network path requires a valid RPCSEC_GSS/Kerberos context or equivalent low-privileged authenticated access, but not administrative privileges on the target.\nUI:N - For a network service such as NFS/RPCSEC_GSS, exploitation is triggered by remote protocol traffic and does not require a local user action on the target.\nS:U - The impact remains within the kernel/security authority of the affected host and does not cross a hypervisor, IOMMU, or separate security scope boundary.\nC:H - The bug can cause asynchronous completion to use request memory after a synchronous caller has freed or unwound it, creating a use-after-free condition that can plausibly expose arbitrary kernel memory.\nI:H - The same use-after-free memory corruption can plausibly be shaped into arbitrary kernel memory corruption or control-flow impact, so high integrity impact is warranted.\nA:H - The commit explicitly notes crashes, and the async completion of freed or invalid request state can reliably oops or panic the kernel."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/crypto/tegra/tegra-se-aes.c",
                        "drivers/crypto/tegra/tegra-se-hash.c"
                    ],
                    "versions": [
                        {
                            "version": "0880bb3b00c855fc244b7177ffdaafef4d0aa1e0",
                            "lessThan": "bdbf027a4504b4a86740de6beb6d18a957331839",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "0880bb3b00c855fc244b7177ffdaafef4d0aa1e0",
                            "lessThan": "3aea268b6d5cde3b087df9eeecc3bc620aa09513",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "0880bb3b00c855fc244b7177ffdaafef4d0aa1e0",
                            "lessThan": "429d05565eb19ee545d8a8395991372adbe4daf3",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "0880bb3b00c855fc244b7177ffdaafef4d0aa1e0",
                            "lessThan": "4b56770d345524fc2acc143a2b85539cf7d74bc1",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/crypto/tegra/tegra-se-aes.c",
                        "drivers/crypto/tegra/tegra-se-hash.c"
                    ],
                    "versions": [
                        {
                            "version": "6.10",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.10",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.81",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18.22",
                            "lessThanOrEqual": "6.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.19.12",
                            "lessThanOrEqual": "6.19.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.0",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.10",
                                    "versionEndExcluding": "6.12.81"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.10",
                                    "versionEndExcluding": "6.18.22"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.10",
                                    "versionEndExcluding": "6.19.12"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.10",
                                    "versionEndExcluding": "7.0"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/bdbf027a4504b4a86740de6beb6d18a957331839"
                },
                {
                    "url": "https://git.kernel.org/stable/c/3aea268b6d5cde3b087df9eeecc3bc620aa09513"
                },
                {
                    "url": "https://git.kernel.org/stable/c/429d05565eb19ee545d8a8395991372adbe4daf3"
                },
                {
                    "url": "https://git.kernel.org/stable/c/4b56770d345524fc2acc143a2b85539cf7d74bc1"
                }
            ],
            "title": "crypto: tegra - Add missing CRYPTO_ALG_ASYNC",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}