CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix double-free of smcspdpriv when tee() duplicates splice pipe buffer
smcrxsplice() allocates one smcspdpriv per pipebuffer and stores the pointer in pipebuffer.private. The pipebufoperations for these buffers used .get = genericpipebufget, which only increments the page reference count when tee(2) duplicates a pipe buffer. The smcspdpriv pointer itself was not handled, so after tee() both the original and the cloned pipebuffer share the same smcspdpriv .
When both pipes are subsequently released, smcrxpipebufrelease() is called twice against the same object:
1st call: kfree(priv) sockput(sk) smcrxupdatecons() [correct] 2nd call: kfree(priv) sockput(sk) smcrxupdatecons() [UAF]
KASAN reports a slab-use-after-free in smcrxpipebufrelease(), which then escalates to a NULL-pointer dereference and kernel panic via smcrxupdateconsumer() when it chases the freed priv->smc pointer:
BUG: KASAN: slab-use-after-free in smcrxpipebufrelease+0x78/0x2a0 Read of size 8 at addr ffff888004a45740 by task smcsplicetee/74 Call Trace: <TASK> dumpstacklvl+0x53/0x70 printreport+0xce/0x650 kasanreport+0xc6/0x100 smcrxpipebufrelease+0x78/0x2a0 freepipeinfo+0xd4/0x130 piperelease+0x142/0x160 fput+0x1c6/0x490 x64sysclose+0x4f/0x90 dosyscall64+0xa6/0x1a0 entrySYSCALL64afterhwframe+0x77/0x7f </TASK>
BUG: kernel NULL pointer dereference, address: 0000000000000020 RIP: 0010:smcrxupdateconsumer+0x8d/0x350 Call Trace: <TASK> smcrxpipebufrelease+0x121/0x2a0 freepipeinfo+0xd4/0x130 piperelease+0x142/0x160 fput+0x1c6/0x490 x64sysclose+0x4f/0x90 dosyscall64+0xa6/0x1a0 entrySYSCALL64afterhwframe+0x77/0x7f </TASK> Kernel panic - not syncing: Fatal exception
Beyond the memory-safety problem, duplicating an SMC splice buffer is semantically questionable: smcrxupdatecons() would advance the consumer cursor twice for the same data, corrupting receive-window accounting. A refcount on smcspdpriv could fix the double-free, but the cursor-accounting issue would still need to be addressed separately.
The .get callback is invoked by both tee(2) and splicepipetopipe() for partial transfers; both will now return -EFAULT. Users who need to duplicate SMC socket data must use a copy-based read path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For affected SMC splice paths, ensure users do not rely on tee(2) duplicating splice pipe buffers; use a copy-based read path for duplicating SMC socket data to avoid triggering the double-free/UAF and related cursor-accounting corruption.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31507?
CVE-2026-31507 has a high severity rating due to the potential for a double-free vulnerability in the kernel.
How do I fix CVE-2026-31507?
To fix CVE-2026-31507, upgrade to the patched version of the Linux kernel provided by your distribution.
What systems are affected by CVE-2026-31507?
CVE-2026-31507 affects the Linux kernel prior to the fix being applied.
What type of vulnerability is CVE-2026-31507?
CVE-2026-31507 is classified as a double-free vulnerability in the context of memory management.
Can CVE-2026-31507 be exploited remotely?
CVE-2026-31507 has potential exploit scenarios but typically requires local access to the affected system.