CVE-2026-74631

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: smc: fix splice entry lifetime imbalance in smc_rx_splice

smc_rx_splice() passes pages to splice_to_pipe() before taking the

references that cover the lifetime of each splice entry. In the

VM-backed RMB path, splice_to_pipe() may drop unqueued entries through

smc_rx_spd_release(), while queued entries are released later via the

pipe buffer callback.

The old post-splice accounting also derives the number of queued VM pages

from an offset mutated while building the descriptor, and a multi-page

splice pairs one sock_hold() with multiple sock_put() calls.

Take the page and socket references for every candidate entry before

splice_to_pipe(), and drop the matching private state, page reference,

and socket reference from smc_rx_spd_release() for entries that never

get queued. This fixes a refcount imbalance that can underflow page

refcounts and trigger a use-after-free.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References