Linux: Double Free
CVE-2026-31507 is a high-severity double free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 7e8916f46c2f48607f907fd401590093753a6bc5, ae5575e660410c8d2c5d38fb28a0f37aea945676, 98ba5cb274768146e25ffbfde47753652c1c20d3 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 7e8916f46c2f48607f907fd401590093753a6bc5 or ae5575e660410c8d2c5d38fb28a0f37aea945676 or 98ba5cb274768146e25ffbfde47753652c1c20d3 or 81acbd345d405994875d419d43b319fee0b9ad62, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.10.253 or 5.15.203 or 6.1.168 or 6.6.131, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f up to, but not including, 7e8916f46c2f48607f907fd401590093753a6bc5; 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f up to, but not including, ae5575e660410c8d2c5d38fb28a0f37aea945676; 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f up to, but not including, 98ba5cb274768146e25ffbfde47753652c1c20d3; 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f up to, but not including, 81acbd345d405994875d419d43b319fee0b9ad62; 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f up to, but not including, 7bcb974c771c863e8588cea0012ac204443a7126; 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f up to, but not including, 54c87a730157868543ebdfa0ecb21b4590ed23a5; 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f up to, but not including, 3cc76380fea749280c026f410af56a28aaac388a; 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f up to, but not including, 24dd586bb4cbba1889a50abe74143817a095c1c9; and 1 more ranges | 7e8916f46c2f48607f907fd401590093753a6bc5, ae5575e660410c8d2c5d38fb28a0f37aea945676, 98ba5cb274768146e25ffbfde47753652c1c20d3, 81acbd345d405994875d419d43b319fee0b9ad62, 7bcb974c771c863e8588cea0012ac204443a7126, 54c87a730157868543ebdfa0ecb21b4590ed23a5 |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Linux | Linux Kernel | 4.18.1 up to, but not including, 5.10.253; 5.11 up to, but not including, 5.15.203; 5.16 up to, but not including, 6.1.168; 6.2 up to, but not including, 6.6.131; 6.7 up to, but not including, 6.12.80; 6.13 up to, but not including, 6.18.21; 6.19 up to, but not including, 6.19.11; 4.18; and 1 more ranges | 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores the pointer in pipe_buffer.private. The pipe_buf_operations for these buffers used .get = generic_pipe_buf_get, which only increments the page reference count when tee(2) duplicates a pipe buffer. The smc_spd_priv pointer itself was not handled, so after tee() both the original and the cloned pipe_buffer share the same smc_spd_priv *. When both pipes are subsequently released, smc_rx_pipe_buf_release() is called twice against the same object: 1st call: kfree(priv) sock_put(sk) smc_rx_update_cons() [correct] 2nd call: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF] KASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which then escalates to a NULL-pointer dereference and kernel panic via smc_rx_update_consumer() when it chases the freed priv->smc pointer: BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0 Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xce/0x650 kasan_report+0xc6/0x100 smc_rx_pipe_buf_release+0x78/0x2a0 free_pipe_info+0xd4/0x130 pipe_release+0x142/0x160 __fput+0x1c6/0x490 __x64_sys_close+0x4f/0x90 do_syscall_64+0xa6/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> BUG: kernel NULL pointer dereference, address: 0000000000000020 RIP: 0010:smc_rx_update_consumer+0x8d/0x350 Call Trace: <TASK> smc_rx_pipe_buf_release+0x121/0x2a0 free_pipe_info+0xd4/0x130 pipe_release+0x142/0x160 __fput+0x1c6/0x490 __x64_sys_close+0x4f/0x90 do_syscall_64+0xa6/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Kernel panic - not syncing: Fatal exception Beyond the memory-safety problem, duplicating an SMC splice buffer is semantically questionable: smc_rx_update_cons() would advance the consumer cursor twice for the same data, corrupting receive-window accounting. A refcount on smc_spd_priv could fix the double-free, but the cursor-accounting issue would still need to be addressed separately. The .get callback is invoked by both tee(2) and splice_pipe_to_pipe() for partial transfers; both will now return -EFAULT. Users who need to duplicate SMC socket data must use a copy-based read path.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Double Free
The product calls free() twice on the same memory address.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
- Use a static analysis tool to find double free instances.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/24dd586bb4cbba1889a50abe74143817a095c1c9
- git.kernel.org/stable/c/3cc76380fea749280c026f410af56a28aaac388a
- git.kernel.org/stable/c/54c87a730157868543ebdfa0ecb21b4590ed23a5
- git.kernel.org/stable/c/7bcb974c771c863e8588cea0012ac204443a7126
- git.kernel.org/stable/c/7e8916f46c2f48607f907fd401590093753a6bc5
- git.kernel.org/stable/c/81acbd345d405994875d419d43b319fee0b9ad62
- git.kernel.org/stable/c/98ba5cb274768146e25ffbfde47753652c1c20d3
- git.kernel.org/stable/c/ae5575e660410c8d2c5d38fb28a0f37aea945676
Other references
Recent Double Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 9.8 Critical severity
Spotted an error? Tell us.