CVE-2026-31507

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer

smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores

the pointer in pipe_buffer.private. The pipe_buf_operations for these

buffers used .get = generic_pipe_buf_get, which only increments the page

reference count when tee(2) duplicates a pipe buffer. The smc_spd_priv

pointer itself was not handled, so after tee() both the original and the

cloned pipe_buffer share the same smc_spd_priv *.

When both pipes are subsequently released, smc_rx_pipe_buf_release() is

called twice against the same object:

1st call: kfree(priv) sock_put(sk) smc_rx_update_cons() [correct]

2nd call: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF]

KASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which

then escalates to a NULL-pointer dereference and kernel panic via

smc_rx_update_consumer() when it chases the freed

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References