CVE-2026-31507

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31507", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.106Z", "datePublished": "2026-04-22T13:54:25.910Z", "dateUpdated": "2026-11-10T12:44:44.881Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:23:09.141Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer\n\nsmc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores\nthe pointer in pipe_buffer.private. The pipe_buf_operations for these\nbuffers used .get = generic_pipe_buf_get, which only increments the page\nreference count when tee(2) duplicates a pipe buffer. The smc_spd_priv\npointer itself was not handled, so after tee() both the original and the\ncloned pipe_buffer share the same smc_spd_priv *.\n\nWhen both pipes are subsequently released, smc_rx_pipe_buf_release() is\ncalled twice against the same object:\n\n 1st call: kfree(priv) sock_put(sk) smc_rx_update_cons() [correct]\n 2nd call: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF]\n\nKASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which\nthen escalates to a NULL-pointer dereference and kernel panic via\nsmc_rx_update_consumer() when it chases the freed priv->smc pointer:\n\n BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0\n Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74\n Call Trace:\n <TASK>\n dump_stack_lvl+0x53/0x70\n print_report+0xce/0x650\n kasan_report+0xc6/0x100\n smc_rx_pipe_buf_release+0x78/0x2a0\n free_pipe_info+0xd4/0x130\n pipe_release+0x142/0x160\n __fput+0x1c6/0x490\n __x64_sys_close+0x4f/0x90\n do_syscall_64+0xa6/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\n BUG: kernel NULL pointer dereference, address: 0000000000000020\n RIP: 0010:smc_rx_update_consumer+0x8d/0x350\n Call Trace:\n <TASK>\n smc_rx_pipe_buf_release+0x121/0x2a0\n free_pipe_info+0xd4/0x130\n pipe_release+0x142/0x160\n __fput+0x1c6/0x490\n __x64_sys_close+0x4f/0x90\n do_syscall_64+0xa6/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n Kernel panic - not syncing: Fatal exception\n\nBeyond the memory-safety problem, duplicating an SMC splice buffer is\nsemantically questionable: smc_rx_update_cons() would advance the\nconsumer cursor twice for the same data, corrupting receive-window\naccounting. A refcount on smc_spd_priv could fix the double-free, but\nthe cursor-accounting issue would still need to be addressed separately.\n\nThe .get callback is invoked by both tee(2) and splice_pipe_to_pipe()\nfor partial transfers; both will now return -EFAULT. Users who need\nto duplicate SMC socket data must use a copy-based read path."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path requires a local process to create or use an established non-fallback SMC socket, splice data from it into a pipe, and then duplicate that pipe buffer with tee(2) or partial pipe-to-pipe splice. A remote SMC peer can supply data, but cannot by itself invoke the required local splice/tee pipe-buffer operations.\nAC:L - There is no race or fragile timing requirement; once SMC data is available, the attacker-controlled syscall sequence deterministically creates two pipe buffers sharing the same smc_spd_priv. SMC-capable hardware/configuration is an affected deployment condition, not an exploitation race.\nPR:L - Creating SMC stream sockets and invoking splice(2), tee(2), pipe(2), and close(2) do not require CAP_NET_ADMIN or other elevated privileges. The attacker needs only basic local code execution.\nUI:N - No victim action is needed once the attacker has local execution; the attacker can perform the full syscall sequence and close both pipes. Any remote peer data needed for the SMC receive buffer can be generated by attacker-controlled endpoints in a plausible deployment.\nS:U - The vulnerability corrupts kernel memory in the same operating-system security authority as the vulnerable SMC/socket/pipe code. It is a standard kernel memory corruption issue, not a VM escape or cross-authority boundary bypass.\nC:H - The bug is a use-after-free/double-free of a heap object containing a kernel pointer and length, and the freed object is dereferenced on the second pipe-buffer release. Following kernel CVSS guidance, this memory corruption can support information disclosure primitives.\nI:H - The duplicate release can lead to allocator corruption and attacker-influenced dereferences through the freed smc_spd_priv contents. Following kernel CVSS guidance for UAF/double-free memory corruption, arbitrary write or control-flow compromise is a defensible impact.\nA:H - The reported failure includes KASAN slab-use-after-free followed by NULL pointer dereference and kernel panic in smc_rx_update_consumer(). Even without full exploitation, the sequence can crash the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/smc/smc_rx.c"], "versions": [{"version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "lessThan": "7e8916f46c2f48607f907fd401590093753a6bc5", "status": "affected", "versionType": "git"}, {"version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "lessThan": "ae5575e660410c8d2c5d38fb28a0f37aea945676", "status": "affected", "versionType": "git"}, {"version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "lessThan": "98ba5cb274768146e25ffbfde47753652c1c20d3", "status": "affected", "versionType": "git"}, {"version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "lessThan": "81acbd345d405994875d419d43b319fee0b9ad62", "status": "affected", "versionType": "git"}, {"version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "lessThan": "7bcb974c771c863e8588cea0012ac204443a7126", "status": "affected", "versionType": "git"}, {"version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "lessThan": "54c87a730157868543ebdfa0ecb21b4590ed23a5", "status": "affected", "versionType": "git"}, {"version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "lessThan": "3cc76380fea749280c026f410af56a28aaac388a", "status": "affected", "versionType": "git"}, {"version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "lessThan": "24dd586bb4cbba1889a50abe74143817a095c1c9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/smc/smc_rx.c"], "versions": [{"version": "4.18", "status": "affected"}, {"version": "0", "lessThan": "4.18", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.168", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.131", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.80", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "5.10.253"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.1.168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.6.131"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.12.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7e8916f46c2f48607f907fd401590093753a6bc5"}, {"url": "https://git.kernel.org/stable/c/ae5575e660410c8d2c5d38fb28a0f37aea945676"}, {"url": "https://git.kernel.org/stable/c/98ba5cb274768146e25ffbfde47753652c1c20d3"}, {"url": "https://git.kernel.org/stable/c/81acbd345d405994875d419d43b319fee0b9ad62"}, {"url": "https://git.kernel.org/stable/c/7bcb974c771c863e8588cea0012ac204443a7126"}, {"url": "https://git.kernel.org/stable/c/54c87a730157868543ebdfa0ecb21b4590ed23a5"}, {"url": "https://git.kernel.org/stable/c/3cc76380fea749280c026f410af56a28aaac388a"}, {"url": "https://git.kernel.org/stable/c/24dd586bb4cbba1889a50abe74143817a095c1c9"}], "title": "net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-11-10T12:44:44.881Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31507", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:10:23.030558Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-415", "description": "CWE-415 Double Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:45:54.233Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-11-10T12:44:44.881Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31507", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:10:23.030558Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:10:23.593Z"}}], "cna": {"title": "net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path requires a local process to create or use an established non-fallback SMC socket, splice data from it into a pipe, and then duplicate that pipe buffer with tee(2) or partial pipe-to-pipe splice. A remote SMC peer can supply data, but cannot by itself invoke the required local splice/tee pipe-buffer operations.\nAC:L - There is no race or fragile timing requirement; once SMC data is available, the attacker-controlled syscall sequence deterministically creates two pipe buffers sharing the same smc_spd_priv. SMC-capable hardware/configuration is an affected deployment condition, not an exploitation race.\nPR:L - Creating SMC stream sockets and invoking splice(2), tee(2), pipe(2), and close(2) do not require CAP_NET_ADMIN or other elevated privileges. The attacker needs only basic local code execution.\nUI:N - No victim action is needed once the attacker has local execution; the attacker can perform the full syscall sequence and close both pipes. Any remote peer data needed for the SMC receive buffer can be generated by attacker-controlled endpoints in a plausible deployment.\nS:U - The vulnerability corrupts kernel memory in the same operating-system security authority as the vulnerable SMC/socket/pipe code. It is a standard kernel memory corruption issue, not a VM escape or cross-authority boundary bypass.\nC:H - The bug is a use-after-free/double-free of a heap object containing a kernel pointer and length, and the freed object is dereferenced on the second pipe-buffer release. Following kernel CVSS guidance, this memory corruption can support information disclosure primitives.\nI:H - The duplicate release can lead to allocator corruption and attacker-influenced dereferences through the freed smc_spd_priv contents. Following kernel CVSS guidance for UAF/double-free memory corruption, arbitrary write or control-flow compromise is a defensible impact.\nA:H - The reported failure includes KASAN slab-use-after-free followed by NULL pointer dereference and kernel panic in smc_rx_update_consumer(). Even without full exploitation, the sequence can crash the kernel."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "lessThan": "7e8916f46c2f48607f907fd401590093753a6bc5", "versionType": "git"}, {"status": "affected", "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "lessThan": "ae5575e660410c8d2c5d38fb28a0f37aea945676", "versionType": "git"}, {"status": "affected", "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "lessThan": "98ba5cb274768146e25ffbfde47753652c1c20d3", "versionType": "git"}, {"status": "affected", "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "lessThan": "81acbd345d405994875d419d43b319fee0b9ad62", "versionType": "git"}, {"status": "affected", "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "lessThan": "7bcb974c771c863e8588cea0012ac204443a7126", "versionType": "git"}, {"status": "affected", "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "lessThan": "54c87a730157868543ebdfa0ecb21b4590ed23a5", "versionType": "git"}, {"status": "affected", "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "lessThan": "3cc76380fea749280c026f410af56a28aaac388a", "versionType": "git"}, {"status": "affected", "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "lessThan": "24dd586bb4cbba1889a50abe74143817a095c1c9", "versionType": "git"}], "programFiles": ["net/smc/smc_rx.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.18"}, {"status": "unaffected", "version": "0", "lessThan": "4.18", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.253", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.203", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.168", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.131", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.80", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.21", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.11", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/smc/smc_rx.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/7e8916f46c2f48607f907fd401590093753a6bc5"}, {"url": "https://git.kernel.org/stable/c/ae5575e660410c8d2c5d38fb28a0f37aea945676"}, {"url": "https://git.kernel.org/stable/c/98ba5cb274768146e25ffbfde47753652c1c20d3"}, {"url": "https://git.kernel.org/stable/c/81acbd345d405994875d419d43b319fee0b9ad62"}, {"url": "https://git.kernel.org/stable/c/7bcb974c771c863e8588cea0012ac204443a7126"}, {"url": "https://git.kernel.org/stable/c/54c87a730157868543ebdfa0ecb21b4590ed23a5"}, {"url": "https://git.kernel.org/stable/c/3cc76380fea749280c026f410af56a28aaac388a"}, {"url": "https://git.kernel.org/stable/c/24dd586bb4cbba1889a50abe74143817a095c1c9"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer\n\nsmc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores\nthe pointer in pipe_buffer.private. The pipe_buf_operations for these\nbuffers used .get = generic_pipe_buf_get, which only increments the page\nreference count when tee(2) duplicates a pipe buffer. The smc_spd_priv\npointer itself was not handled, so after tee() both the original and the\ncloned pipe_buffer share the same smc_spd_priv *.\n\nWhen both pipes are subsequently released, smc_rx_pipe_buf_release() is\ncalled twice against the same object:\n\n 1st call: kfree(priv) sock_put(sk) smc_rx_update_cons() [correct]\n 2nd call: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF]\n\nKASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which\nthen escalates to a NULL-pointer dereference and kernel panic via\nsmc_rx_update_consumer() when it chases the freed priv->smc pointer:\n\n BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0\n Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74\n Call Trace:\n <TASK>\n dump_stack_lvl+0x53/0x70\n print_report+0xce/0x650\n kasan_report+0xc6/0x100\n smc_rx_pipe_buf_release+0x78/0x2a0\n free_pipe_info+0xd4/0x130\n pipe_release+0x142/0x160\n __fput+0x1c6/0x490\n __x64_sys_close+0x4f/0x90\n do_syscall_64+0xa6/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\n BUG: kernel NULL pointer dereference, address: 0000000000000020\n RIP: 0010:smc_rx_update_consumer+0x8d/0x350\n Call Trace:\n <TASK>\n smc_rx_pipe_buf_release+0x121/0x2a0\n free_pipe_info+0xd4/0x130\n pipe_release+0x142/0x160\n __fput+0x1c6/0x490\n __x64_sys_close+0x4f/0x90\n do_syscall_64+0xa6/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n Kernel panic - not syncing: Fatal exception\n\nBeyond the memory-safety problem, duplicating an SMC splice buffer is\nsemantically questionable: smc_rx_update_cons() would advance the\nconsumer cursor twice for the same data, corrupting receive-window\naccounting. A refcount on smc_spd_priv could fix the double-free, but\nthe cursor-accounting issue would still need to be addressed separately.\n\nThe .get callback is invoked by both tee(2) and splice_pipe_to_pipe()\nfor partial transfers; both will now return -EFAULT. Users who need\nto duplicate SMC socket data must use a copy-based read path."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.253", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.203", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.168", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.131", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.80", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.21", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.11", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "4.18"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:23:09.141Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31507", "state": "PUBLISHED", "dateUpdated": "2026-11-10T12:44:44.881Z", "dateReserved": "2026-03-09T15:48:24.106Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-22T13:54:25.910Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/smc/smc_rx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7e8916f46c2f48607f907fd401590093753a6bc5", "status": "affected", "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "versionType": "git"}, {"lessThan": "ae5575e660410c8d2c5d38fb28a0f37aea945676", "status": "affected", "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "versionType": "git"}, {"lessThan": "98ba5cb274768146e25ffbfde47753652c1c20d3", "status": "affected", "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "versionType": "git"}, {"lessThan": "81acbd345d405994875d419d43b319fee0b9ad62", "status": "affected", "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "versionType": "git"}, {"lessThan": "7bcb974c771c863e8588cea0012ac204443a7126", "status": "affected", "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "versionType": "git"}, {"lessThan": "54c87a730157868543ebdfa0ecb21b4590ed23a5", "status": "affected", "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "versionType": "git"}, {"lessThan": "3cc76380fea749280c026f410af56a28aaac388a", "status": "affected", "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "versionType": "git"}, {"lessThan": "24dd586bb4cbba1889a50abe74143817a095c1c9", "status": "affected", "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/smc/smc_rx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.18"}, {"lessThan": "4.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.253", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.203", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.168", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.131", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.80", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "874956BE-5D82-4514-AA62-A1CCA27A0891", "versionEndExcluding": "5.10.253", "versionStartIncluding": "4.18.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B", "versionEndExcluding": "6.1.168", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CE6ED4D4-0046-4573-BFA9-D64143B6A89F", "versionEndExcluding": "6.6.131", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6", "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED39847A-3B46-4729-B7CA-B2C30B9FA8FE", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.18:-:*:*:*:*:*:*", "matchCriteriaId": "6AE7DC47-EAFA-42D5-BCF5-C7039EE3D771", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer\n\nsmc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores\nthe pointer in pipe_buffer.private. The pipe_buf_operations for these\nbuffers used .get = generic_pipe_buf_get, which only increments the page\nreference count when tee(2) duplicates a pipe buffer. The smc_spd_priv\npointer itself was not handled, so after tee() both the original and the\ncloned pipe_buffer share the same smc_spd_priv *.\n\nWhen both pipes are subsequently released, smc_rx_pipe_buf_release() is\ncalled twice against the same object:\n\n 1st call: kfree(priv) sock_put(sk) smc_rx_update_cons() [correct]\n 2nd call: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF]\n\nKASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which\nthen escalates to a NULL-pointer dereference and kernel panic via\nsmc_rx_update_consumer() when it chases the freed priv->smc pointer:\n\n BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0\n Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74\n Call Trace:\n <TASK>\n dump_stack_lvl+0x53/0x70\n print_report+0xce/0x650\n kasan_report+0xc6/0x100\n smc_rx_pipe_buf_release+0x78/0x2a0\n free_pipe_info+0xd4/0x130\n pipe_release+0x142/0x160\n __fput+0x1c6/0x490\n __x64_sys_close+0x4f/0x90\n do_syscall_64+0xa6/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\n BUG: kernel NULL pointer dereference, address: 0000000000000020\n RIP: 0010:smc_rx_update_consumer+0x8d/0x350\n Call Trace:\n <TASK>\n smc_rx_pipe_buf_release+0x121/0x2a0\n free_pipe_info+0xd4/0x130\n pipe_release+0x142/0x160\n __fput+0x1c6/0x490\n __x64_sys_close+0x4f/0x90\n do_syscall_64+0xa6/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n Kernel panic - not syncing: Fatal exception\n\nBeyond the memory-safety problem, duplicating an SMC splice buffer is\nsemantically questionable: smc_rx_update_cons() would advance the\nconsumer cursor twice for the same data, corrupting receive-window\naccounting. A refcount on smc_spd_priv could fix the double-free, but\nthe cursor-accounting issue would still need to be addressed separately.\n\nThe .get callback is invoked by both tee(2) and splice_pipe_to_pipe()\nfor partial transfers; both will now return -EFAULT. Users who need\nto duplicate SMC socket data must use a copy-based read path."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/smc: solucionar la doble liberaci\u00f3n de smc_spd_priv cuando tee() duplica el b\u00fafer de tuber\u00eda de empalme\n\nsmc_rx_splice() asigna un smc_spd_priv por pipe_buffer y almacena el puntero en pipe_buffer.private. Las pipe_buf_operations para estos b\u00faferes utilizaban .get = generic_pipe_buf_get, que solo incrementa el contador de referencias de p\u00e1gina cuando tee(2) duplica un b\u00fafer de tuber\u00eda. El puntero smc_spd_priv en s\u00ed no se manejaba, as\u00ed que despu\u00e9s de tee() tanto el pipe_buffer original como el clonado comparten el mismo smc_spd_priv *.\n\nCuando ambas tuber\u00edas son liberadas posteriormente, smc_rx_pipe_buf_release() es llamada dos veces contra el mismo objeto:\n\n 1\u00aa llamada: kfree(priv) sock_put(sk) smc_rx_update_cons() [correcto]\n 2\u00aa llamada: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF]\n\nKASAN informa de un uso despu\u00e9s de liberaci\u00f3n de slab en smc_rx_pipe_buf_release(), que luego escala a una desreferencia de puntero NULL y un p\u00e1nico del kernel a trav\u00e9s de smc_rx_update_consumer() cuando persigue el puntero priv -> smc liberado:\n\n ERROR: KASAN: uso despu\u00e9s de liberaci\u00f3n de slab en smc_rx_pipe_buf_release+0x78/0x2a0\n Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff888004a45740 por la tarea smc_splice_tee_/74\n Rastro de Llamada:\n [TAREA]\n dump_stack_lvl+0x53/0x70\n print_report+0xce/0x650\n kasan_report+0xc6/0x100\n smc_rx_pipe_buf_release+0x78/0x2a0\n free_pipe_info+0xd4/0x130\n pipe_release+0x142/0x160\n __fput+0x1c6/0x490\n __x64_sys_close+0x4f/0x90\n do_syscall_64+0xa6/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n [/TAREA]\n\n ERROR: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000020\n RIP: 0010:smc_rx_update_consumer+0x8d/0x350\n Rastro de Llamada:\n [TAREA]\n smc_rx_pipe_buf_release+0x121/0x2a0\n free_pipe_info+0xd4/0x130\n pipe_release+0x142/0x160\n __fput+0x1c6/0x490\n __x64_sys_close+0x4f/0x90\n do_syscall_64+0xa6/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n [/TAREA]\n P\u00e1nico del kernel - no sincronizando: Excepci\u00f3n fatal\n\nM\u00e1s all\u00e1 del problema de seguridad de la memoria, duplicar un b\u00fafer de empalme SMC es sem\u00e1nticamente cuestionable: smc_rx_update_cons() avanzar\u00eda el cursor del consumidor dos veces para los mismos datos, corrompiendo la contabilidad de la ventana de recepci\u00f3n. Un contador de referencias en smc_spd_priv podr\u00eda solucionar la doble liberaci\u00f3n, pero el problema de contabilidad del cursor a\u00fan necesitar\u00eda ser abordado por separado.\n\nLa devoluci\u00f3n de llamada .get es invocada tanto por tee(2) como por splice_pipe_to_pipe() para transferencias parciales; ambos ahora devolver\u00e1n -EFAULT. Los usuarios que necesiten duplicar datos de socket SMC deben usar una ruta de lectura basada en copia."}], "id": "CVE-2026-31507", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31507", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:10:23.030558Z", "version": "2.0.3"}}]}, "published": "2026-04-22T14:16:49.523", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/24dd586bb4cbba1889a50abe74143817a095c1c9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3cc76380fea749280c026f410af56a28aaac388a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/54c87a730157868543ebdfa0ecb21b4590ed23a5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7bcb974c771c863e8588cea0012ac204443a7126"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7e8916f46c2f48607f907fd401590093753a6bc5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/81acbd345d405994875d419d43b319fee0b9ad62"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/98ba5cb274768146e25ffbfde47753652c1c20d3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ae5575e660410c8d2c5d38fb28a0f37aea945676"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-415"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-415"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer", "id": "2460706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460706"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SMC) module. A local user can exploit this vulnerability by using the tee(2) system call to duplicate a splice pipe buffer, leading to a double-free condition. This double-free can result in a use-after-free error and a kernel null pointer dereference, ultimately causing a kernel panic and a denial of service on the affected system."], "name": "CVE-2026-31507", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31507\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31507\nhttps://lore.kernel.org/linux-cve-announce/2026042207-CVE-2026-31507-cbc0@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,7e8916f46c2f48607f907fd401590093753a6bc5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,ae5575e660410c8d2c5d38fb28a0f37aea945676)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,98ba5cb274768146e25ffbfde47753652c1c20d3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,81acbd345d405994875d419d43b319fee0b9ad62)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,7bcb974c771c863e8588cea0012ac204443a7126)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,54c87a730157868543ebdfa0ecb21b4590ed23a5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,3cc76380fea749280c026f410af56a28aaac388a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,24dd586bb4cbba1889a50abe74143817a095c1c9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.253,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.203,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.168,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.131,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.80,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.21,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.11,6.19.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-29T00:01:22.180087+00:00", "value": {"mitigation_remediation": ["Apply a kernel update that includes the patch for the double\u2011free in the SMC splice path.", "If an immediate update is infeasible, rebuild the kernel from source with the relevant commit applied and reboot into the patched kernel.", "As a temporary workaround, avoid using tee() or splice() on SMC sockets; use a copy\u2011based read path or disable the SMC subsystem if it is not required."], "summary": {"action": "Immediate Patch", "impact": "Kernel crash leading to denial of service"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in any Linux kernel that implements the SMC splice path without the patch that adds a refcount to smc_spd_priv. In practice this includes all unpatched kernel releases before the commit that introduced the fix, meaning most distributions deploying kernels older than the update. Users with a functioning SMC socket that can invoke tee or splice are affected. It is inferred that any distribution using an unpatched kernel before the fix is vulnerable, given the vendor list of Linux:Linux.", "description_and_impact": "A double\u2011free of the smc_spd_priv structure occurs when the tee(2) system call duplicates a splice pipe buffer within the Linux kernel\u2019s SMC subsystem, a classic double\u2011free vulnerability (CWE-415). The duplicated buffers share the same smc_spd_priv pointer, so when either pipe is released the cleanup routine frees the same private data twice, triggering a use\u2011after\u2011free (CWE-911) that escalates to a NULL\u2011pointer dereference and a kernel panic. The crash effectively denies all services running on the affected machine because the kernel dies.\n\nBased on the description, it is inferred that the double\u2011free can be triggered by calling tee or splice on an SMC socket, which requires the process to have local access to such a socket.\n\nThe kernel panic results in a system\u2011wide denial of service, preventing all kernel services from operating normally.", "risk_and_exploitability": "The CVSS score for this issue is 7.8 and the EPSS score is below 1%, indicating a low but non\u2011zero probability of exploitation. It is not listed in the CISA KEV catalog. Attackers require local access to an SMC socket and can induce the double\u2011free by performing tee or splice operations, resulting in a kernel panic and a denial\u2011of\u2011service condition. Based on the description, it is inferred that the attacker must have local privileges or direct control of an SMC socket; no remote exploitation path is indicated. No public exploit is known, but the crash susceptibility warrants immediate remediation."}}}}, "created": "2026-04-22T18:45:23.769817+00:00", "updated": "2026-04-29T00:15:43.455494+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}