PT-2026-34412 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-31507

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A double-free issue exists in the SMC implementation of the Linux kernel. The smc rx splice() function allocates an smc spd priv object per pipe buffer and stores the pointer in pipe buffer.private. When the tee() system call duplicates a pipe buffer, the smc spd priv pointer is shared between the original and the cloned buffer because the .get callback only increments the page reference count. Consequently, when both pipes are released, the smc rx pipe buf release() function is called twice for the same object, leading to a slab-use-after-free and a potential kernel panic via a NULL-pointer dereference in the smc rx update consumer() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2026-31507

ECHO-18AF-EF6C-D0FA

Affected Products

Linux Kernel

References · 18

• https://git.kernel.org/stable/c/7e8916f46c2f48607f907fd401590093753a6bc5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31507 · Security Note
• https://git.kernel.org/stable/c/24dd586bb4cbba1889a50abe74143817a095c1c9 · Patch
• https://git.kernel.org/stable/c/98ba5cb274768146e25ffbfde47753652c1c20d3 · Patch
• https://git.kernel.org/stable/c/81acbd345d405994875d419d43b319fee0b9ad62 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31507 · Vendor Advisory
• https://git.kernel.org/stable/c/ae5575e660410c8d2c5d38fb28a0f37aea945676 · Patch
• https://git.kernel.org/stable/c/54c87a730157868543ebdfa0ecb21b4590ed23a5 · Patch
• https://git.kernel.org/stable/c/7bcb974c771c863e8588cea0012ac204443a7126 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-31507 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31507 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31507 · Security Note
• https://ubuntu.com/security/CVE-2026-31507 · Vendor Advisory
• https://git.kernel.org/stable/c/3cc76380fea749280c026f410af56a28aaac388a · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-31507 · Vendor Advisory