LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores the pointer in pipe_buffer.private. The pipe_buf_operations for these buffers used .get = generic_pipe_buf_get, which only increments the page reference count when tee(2) duplicates a pipe buffer. The smc_spd_priv pointer itself was not handled, so after tee() both the original and the cloned pipe_buffer share the same smc_spd_priv *. When both pipes are subsequently released, smc_rx_pipe_buf_release() is called twice against the same object: 1st call: kfree(priv) sock_put(sk) smc_rx_update_cons() [correct] 2nd call: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF] KASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which then escalates to a NULL-pointer dereference and kernel panic via smc_rx_update_consumer() when it chases the freed priv->smc pointer: BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0 Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xce/0x650 kasan_report+0xc6/0x100 smc_rx_pipe_buf_release+0x78/0x2a0 free_pipe_info+0xd4/0x130 pipe_release+0x142/0x160 __fput+0x1c6/0x490 __x64_sys_close+0x4f/0x90 do_syscall_64+0xa6/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> BUG: kernel NULL pointer dereference, address: 0000000000000020 RIP: 0010:smc_rx_update_consumer+0x8d/0x350 Call Trace: <TASK> smc_rx_pipe_buf_release+0x121/0x2a0 free_pipe_info+0xd4/0x130 pipe_release+0x142/0x160 __fput+0x1c6/0x490 __x64_sys_close+0x4f/0x90 do_syscall_64+0xa6/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Kernel panic - not syncing: Fatal exception Beyond the memory-safety problem, duplicating an SMC splice buffer is semantically questionable: smc_rx_update_cons() would advance the consumer cursor twice for the same data, corrupting receive-window accounting. A refcount on smc_spd_priv could fix the double-free, but the cursor-accounting issue would still need to be addressed separately. The .get callback is invoked by both tee(2) and splice_pipe_to_pipe() for partial transfers; both will now return -EFAULT. Users who need to duplicate SMC socket data must use a copy-based read path.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel networking flaw can free the same object twice when a local process duplicates data from an SMC socket. This may corrupt kernel memory and crash the host. The supplied CVSS score is 7.8 (High), requiring local low-privileged access. The bundle provides no evidence of active exploitation.

Executive priority

Prioritize rapid patching for multi-user, shared-compute, or appliance environments that use SMC and permit local untrusted workloads. For systems without SMC use, urgency is lower but inventory and normal kernel remediation remain appropriate because a successful trigger can crash the operating system.

Technical view

SMC splice pipe buffers can share one smc_spd_priv pointer because the former get callback increased only the page reference. Releasing both buffers causes a double-free and use-after-free, potentially followed by a NULL dereference and kernel panic. The stable fixes reject tee duplication and affected partial pipe transfers with EFAULT, also preventing duplicate receive-cursor updates.

Likely exposure

Exposure requires Linux SMC socket use, an affected kernel, and a local process able to reach the relevant tee or splice behavior. The supplied version data does not clearly distinguish every vulnerable and fixed boundary, so distributions and embedded vendors should map their builds against the referenced stable fixes.

Exploitation context

The supplied vector describes local, low-complexity exploitation by a low-privileged user without interaction. Reproduction produced memory-safety violations and a kernel panic. Although the CVSS vector rates confidentiality, integrity, and availability impacts as high, the narrative directly demonstrates denial of service. KEV is false, and no cited evidence establishes active exploitation.

Researcher notes

The fix intentionally rejects pipe-buffer duplication rather than merely reference-counting smc_spd_priv. Reference counting alone would leave incorrect receive-window accounting because both releases could advance the consumer cursor for identical data. Exact affected-version boundaries are not sufficiently clear in the supplied normalized version list and should be confirmed through stable commits or vendor backports.

Mitigation direction

  • Install a vendor kernel update containing the applicable referenced Linux stable fix.
  • Verify distribution backports instead of relying only on the displayed kernel version.
  • Where patching is delayed, avoid duplicating SMC socket data through tee or affected splice transfers.
  • Use a copy-based read path when SMC socket data must be duplicated.
  • Check relevant Linux or product-vendor advisories for platform-specific remediation guidance.

Validation and detection

  • Inventory systems with Linux SMC support and workloads that actively use SMC sockets.
  • Map each deployed kernel build to vendor advisories and the referenced stable commits.
  • Confirm patched behavior rejects affected duplication or partial transfer paths with EFAULT.
  • Review kernel logs for relevant KASAN reports, use-after-free faults, NULL dereferences, or unexplained panics.
  • Regression-test SMC receive processing and any applications depending on zero-copy pipe operations.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31507 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-31507Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux9014db202cb764b8e14c53e7bacc81f9a1a2ba7f, 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f, 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f, 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f, 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f, 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f, 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f, 9014db202cb764b8e14c53e7bacc81f9a1a2ba7funaffected
LinuxLinux4.18, 0, 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.