{
"schemaVersion": 1,
"attribution": [
{
"source": "CISA Known Exploited Vulnerabilities",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"licence": "US government work"
},
{
"source": "GitHub Advisory Database",
"url": "https://github.com/advisories",
"licence": "CC BY 4.0"
},
{
"source": "Have I Been Pwned",
"url": "https://haveibeenpwned.com/",
"licence": "CC BY 4.0"
},
{
"source": "CVE Program (CVE records)",
"url": "https://www.cve.org/Legal/TermsOfUse",
"licence": "CVE Terms of Use",
"notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
"terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
},
{
"source": "FIRST EPSS",
"url": "https://www.first.org/epss/",
"licence": "free to use; FIRST requests attribution"
}
],
"record": {
"id": "CVE-2026-31507",
"sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-31507",
"idYear": 2026,
"status": "PUBLISHED",
"publishedAt": "2026-04-22T13:54:25.910Z",
"updatedAt": "2026-10-19T18:45:54.233Z",
"importedAt": "2026-10-24T01:58:02.025Z",
"snapshot": {
"id": "cve_2026-10-24_midnight_baseline",
"at": "2026-10-24T00:00:00.000Z",
"source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
},
"facts": {
"title": "net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer",
"summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer\n\nsmc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores\nthe pointer in pipe_buffer.private. The pipe_buf_operations for these\nbuffers used .get = generic_pipe_buf_get, which only increments the page\nreference count when tee(2) duplicates a pipe buffer. The smc_spd_priv\npointer itself was not handled, so after tee() both the original and the\ncloned pipe_buffer share the same smc_spd_priv *.\n\nWhen both pipes are subsequently released, smc_rx_pipe_buf_release() is\ncalled twice against the same object:\n\n 1st call: kfree(priv) sock_put(sk) smc_rx_update_cons() [correct]\n 2nd call: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF]\n\nKASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which\nthen escalates to a NULL-pointer dereference and kernel panic via\nsmc_rx_update_consumer() when it chases the freed priv->smc pointer:\n\n BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0\n Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74\n Call Trace:\n \n dump_stack_lvl+0x53/0x70\n print_report+0xce/0x650\n kasan_report+0xc6/0x100\n smc_rx_pipe_buf_release+0x78/0x2a0\n free_pipe_info+0xd4/0x130\n pipe_release+0x142/0x160\n __fput+0x1c6/0x490\n __x64_sys_close+0x4f/0x90\n do_syscall_64+0xa6/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \n\n BUG: kernel NULL pointer dereference, address: 0000000000000020\n RIP: 0010:smc_rx_update_consumer+0x8d/0x350\n Call Trace:\n \n smc_rx_pipe_buf_release+0x121/0x2a0\n free_pipe_info+0xd4/0x130\n pipe_release+0x142/0x160\n __fput+0x1c6/0x490\n __x64_sys_close+0x4f/0x90\n do_syscall_64+0xa6/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \n Kernel panic - not syncing: Fatal exception\n\nBeyond the memory-safety problem, duplicating an SMC splice buffer is\nsemantically questionable: smc_rx_update_cons() would advance the\nconsumer cursor twice for the same data, corrupting receive-window\naccounting. A refcount on smc_spd_priv could fix the double-free, but\nthe cursor-accounting issue would still need to be addressed separately.\n\nThe .get callback is invoked by both tee(2) and splice_pipe_to_pipe()\nfor partial transfers; both will now return -EFAULT. Users who need\nto duplicate SMC socket data must use a copy-based read path.",
"affected": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"versions": [
{
"version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
"status": "affected",
"versionType": "git",
"lessThan": "7e8916f46c2f48607f907fd401590093753a6bc5"
},
{
"version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
"status": "affected",
"versionType": "git",
"lessThan": "ae5575e660410c8d2c5d38fb28a0f37aea945676"
},
{
"version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
"status": "affected",
"versionType": "git",
"lessThan": "98ba5cb274768146e25ffbfde47753652c1c20d3"
},
{
"version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
"status": "affected",
"versionType": "git",
"lessThan": "81acbd345d405994875d419d43b319fee0b9ad62"
},
{
"version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
"status": "affected",
"versionType": "git",
"lessThan": "7bcb974c771c863e8588cea0012ac204443a7126"
},
{
"version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
"status": "affected",
"versionType": "git",
"lessThan": "54c87a730157868543ebdfa0ecb21b4590ed23a5"
},
{
"version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
"status": "affected",
"versionType": "git",
"lessThan": "3cc76380fea749280c026f410af56a28aaac388a"
},
{
"version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
"status": "affected",
"versionType": "git",
"lessThan": "24dd586bb4cbba1889a50abe74143817a095c1c9"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"versions": [
{
"version": "4.18",
"status": "affected"
},
{
"version": "0",
"status": "unaffected",
"versionType": "semver",
"lessThan": "4.18"
},
{
"version": "5.10.253",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"version": "5.15.203",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"version": "6.1.168",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"version": "6.6.131",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"version": "6.12.80",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"version": "6.18.21",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"version": "6.19.11",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"version": "7.0",
"status": "unaffected",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
]
}
]
}
}
}