CVE-2026-31787

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xen/privcmd: fix double free via VMA splitting

privcmd_vm_ops defines .close (privcmd_close), but neither .may_split

nor .open. When userspace does a partial munmap() on a privcmd mapping,

the kernel splits the VMA via __split_vma(). Since may_split is NULL,

the split is allowed. vm_area_dup() copies vm_private_data (a pages

array allocated in alloc_empty_pages()) into the new VMA without any

fixup, because there is no .open callback.

Both VMAs now point to the same pages array. When the unmapped portion

is closed, privcmd_close() calls:

- xen_unmap_domain_gfn_range()

- xen_free_unpopulated_pages()

- kvfree(pages)

The surviving VMA still holds the dangling pointer. When it is later

destroyed, the same sequence runs again, which leads to a double free.

Fix this issue by adding a .may_split callback denying the VMA split.

This is XSA-487 / CVE-2026-31787

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References