ABB Ability Edgenius Linux Kernel Local Privilege Escalation (CVE-2026-31431)

Technical Analysis

CVE-2026-31431 stems from an incorrect 'in-place operation' in the Linux kernel's algif_aead cryptographic algorithm interface (CWE-669: Incorrect Resource Transfer Between Spheres), where source and destination data mappings diverge, causing improper memory handling. This affects kernels used across most major Linux distributions since 2017, and in ABB Ability Edgenius specifically impacts the bE100, E3100C gateway, and vE1000 server products running versions >=3.2.0.0 and <3.2.4.1. Exploitation requires local access (SSH or physical) but does not require special privileges beyond basic authentication (PR:L), allowing an attacker or compromised container workload to escalate to root, execute arbitrary code, or crash the node (CVSS 3.1: 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Since Edgenius is described as an edge computing platform that hosts applications delivering 'AI-driven recommendations' and processes operational data from OT/ICS environments, any AI agent or automation workload running as a container tenant on an affected Edgenius node could be leveraged as the initial local foothold to escalate privileges and compromise the entire edge host, undermining the integrity of AI-driven decision pipelines built on this platform.

Affected Systems

ABB Ability Edgenius versions >=3.2.0.0 and <3.2.4.1 installed on ABB Ability Edgenius Gateway - bE100, ABB Ability Edgenius Gateway - E3100C, and ABB Ability Edgenius Server - vE1000. Underlying Linux kernel algif_aead cryptographic subsystem affected across most major Linux distributions since 2017.

Indicators of Compromise

• No known IOCs; vulnerability not reported as actively exploited at time of disclosure.

Remediation Steps

1. 1

   Apply vendor patch

   Update ABB Ability Edgenius to version 3.2.4.1, which incorporates the corrected Linux kernel security update.

2. 2

   Restrict local/SSH access

   Limit access to SSH and Cockpit management interfaces to trusted administrators only, reducing the pool of potential local attackers.

3. 3

   Isolate control system networks

   Ensure Edgenius devices and OT networks are not internet-facing; place them behind firewalls and segregate from business/IT networks.

4. 4

   Restrict container workloads

   Audit and limit privileges of container workloads running on Edgenius nodes, especially any AI/automation agents, to prevent them from being used as an escalation vector.

5. 5

   Use secure remote access

   If remote access is required, use up-to-date VPN solutions rather than direct exposure of management interfaces.

6. 6

   Monitor for suspicious activity

   Report any suspected exploitation attempts to CISA and ABB PSIRT for tracking and correlation.