PT-2026-35874 · Linux · Linux Kernel

0Xath4Rv + 2 · Published 2026-04-28 · Updated 2026-05-15 · CVE-2026-31787

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A double free issue exists in the Xen privcmd driver. The privcmd vm ops defines a .close function (privcmd close) but lacks .may split and .open callbacks. When a partial munmap() is performed on a privcmd mapping, the kernel splits the Virtual Memory Area (VMA) via split vma(). Because may split is NULL, the split is permitted, and vm area dup() copies the vm private data (a pages array) into the new VMA. Consequently, both VMAs point to the same pages array. When the unmapped portion is closed, privcmd close() frees the pages array, leaving the surviving VMA with a dangling pointer. A subsequent destruction of the surviving VMA triggers the same sequence, resulting in a double free.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2026-31787

ECHO-5C35-1B51-E284

OESA-2026-2311

OPENSUSE-SU-2026:10703-1

Affected Products

Linux Kernel

References · 119

• https://nvd.nist.gov/vuln/detail/CVE-2026-31404 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31773 · Security Note
• https://git.kernel.org/stable/c/1576ff3869cbd3620717195f971c85b7d7fd62b5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31560 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31673 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31504 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43020 · Security Note
• https://git.kernel.org/stable/c/2b985d3a024b9e8c24e21671b34e855569763808 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31630 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31523 · Security Note
• https://git.kernel.org/stable/c/71bf829800758a6e3889096e4754ef47ba7fc850 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31441 · Security Note
• https://git.kernel.org/stable/c/2894a351fe2ea8684919d36df3188b9a35e3926f · Patch
• https://cve.org/CVERecord?id=CVE-2026-31787 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31521 · Security Note