CVE-2026-31507
published 2026-04-22CVE-2026-31507: In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
3.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores
the pointer in pipe_buffer.private. The pipe_buf_operations for these
buffers used .get = generic_pipe_buf_get, which only increments the page
reference count when tee(2) duplicates a pipe buffer. The smc_spd_priv
pointer itself was not handled, so after tee() both the original and the
cloned pipe_buffer share the same smc_spd_priv *.
When both pipes are subsequently released, smc_rx_pipe_buf_release() is
called twice against the same object:
1st call: kfree(priv) sock_put(sk) smc_rx_update_cons() [correct]
2nd call: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF]
KASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which
then escalates to a NULL-pointer dereference and kernel panic via
smc_rx_update_consumer() when it chases the freed priv->smc pointer:
BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0
Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74
Call Trace:
dump_stack_lvl+0x53/0x70
print_report+0xce/0x650
kasan_report+0xc6/0x100
smc_rx_pipe_buf_release+0x78/0x2a0
free_pipe_info+0xd4/0x130
pipe_release+0x142/0x160
__fput+0x1c6/0x490
__x64_sys_close+0x4f/0x90
do_syscall_64+0xa6/0x1a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: kernel NULL pointer dereference, address: 0000000000000020
RIP: 0010:smc_rx_update_consumer+0x8d/0x350
Call Trace:
smc_rx_pipe_buf_release+0x121/0x2a0
free_pipe_info+0xd4/0x130
pipe_release+0x142/0x160
__fput+0x1c6/0x490
__x64_sys_close+0x4f/0x90
do_syscall_64+0xa6/0x1a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Kernel panic - not syncing: Fatal exception
Beyond the memory-safety problem, duplicating an SMC splice buffer is
semantically questionable: smc_rx_update_cons() would advance the
consumer cursor twice for the same data, corrupting receive-window
ac
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f < 7e8916f46c2f48607f907fd401590093753a6bc5 | 7e8916f46c2f48607f907fd401590093753a6bc5 |
| linux | linux | >= 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f < ae5575e660410c8d2c5d38fb28a0f37aea945676 | ae5575e660410c8d2c5d38fb28a0f37aea945676 |
| linux | linux | >= 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f < 98ba5cb274768146e25ffbfde47753652c1c20d3 | 98ba5cb274768146e25ffbfde47753652c1c20d3 |
| linux | linux | >= 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f < 81acbd345d405994875d419d43b319fee0b9ad62 | 81acbd345d405994875d419d43b319fee0b9ad62 |
| linux | linux | >= 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f < 7bcb974c771c863e8588cea0012ac204443a7126 | 7bcb974c771c863e8588cea0012ac204443a7126 |
| linux | linux | >= 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f < 54c87a730157868543ebdfa0ecb21b4590ed23a5 | 54c87a730157868543ebdfa0ecb21b4590ed23a5 |
| linux | linux | >= 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f < 3cc76380fea749280c026f410af56a28aaac388a | 3cc76380fea749280c026f410af56a28aaac388a |
| linux | linux | >= 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f < 24dd586bb4cbba1889a50abe74143817a095c1c9 | 24dd586bb4cbba1889a50abe74143817a095c1c9 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 4.18.1 < 5.10.253 | 5.10.253 |
| linux | linux_kernel | >= 5.11 < 5.15.203 | 5.15.203 |
| linux | linux_kernel | >= 5.16 < 6.1.168 | 6.1.168 |
| linux | linux_kernel | >= 6.13 < 6.18.21 | 6.18.21 |
| linux | linux_kernel | >= 6.19 < 6.19.11 | 6.19.11 |
| linux | linux_kernel | >= 6.2 < 6.6.131 | 6.6.131 |
| linux | linux_kernel | >= 6.7 < 6.12.80 | 6.12.80 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xf3q-f592-rmgx: In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
ghsa_unreviewed·2026-04-22
CVE-2026-31507 GHSA-xf3q-f592-rmgx: In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores
the pointer in pipe_buffer.private. The pipe_buf_operations for these
buffers used .get = generic_pipe_buf_get, which only increments the page
reference count when tee(2) duplicates a pipe buffer. The smc_spd_priv
pointer itself was not handled, so after tee() both the original and the
cloned pipe_buffer share the same smc_spd_priv *.
When both pipes are subsequently released, smc_rx_pipe_buf_release() is
called twice against the same object:
1st call: kfree(priv) sock_put(sk) smc_rx_update_cons() [correct]
2nd call: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF]
Red Hat
kernel: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
vendor_redhat·2026-04-22·CVSS 7.0
CVE-2026-31507 [MEDIUM] CWE-911 kernel: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
kernel: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SMC) module. A local user can exploit this vulnerability by using the tee(2) system call to duplicate a splice pipe buffer, leading to a double-free condition. This double-free can result in a use-after-free error and a kernel null pointer dereference, ultimately causing a kernel panic and a denial of service on the affected system.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Affec
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/24dd586bb4cbba1889a50abe74143817a095c1c9https://git.kernel.org/stable/c/3cc76380fea749280c026f410af56a28aaac388ahttps://git.kernel.org/stable/c/54c87a730157868543ebdfa0ecb21b4590ed23a5https://git.kernel.org/stable/c/7bcb974c771c863e8588cea0012ac204443a7126https://git.kernel.org/stable/c/7e8916f46c2f48607f907fd401590093753a6bc5https://git.kernel.org/stable/c/81acbd345d405994875d419d43b319fee0b9ad62https://git.kernel.org/stable/c/98ba5cb274768146e25ffbfde47753652c1c20d3https://git.kernel.org/stable/c/ae5575e660410c8d2c5d38fb28a0f37aea945676https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-082556.html
2026-04-22
Published