Memory Safety Vulnerability in Linux Kernel Affecting Socket Data Management

CVE-2026-31507

What is CVE-2026-31507?

A vulnerability in the Linux kernel has been identified where improper handling of socket memory management leads to a double-free condition. The issue arises when the tee() system call duplicates a splice pipe buffer, allowing both the original and cloned pipe buffers to reference the same smc_spd_priv object. This mismanagement results in a potential kernel panic due to a NULL pointer dereference when both pipe buffers are released. Additionally, the current implementation can corrupt receive-window accounting, as the system erroneously advances the consumer cursor twice for the same data. A refcount mechanism must be employed to resolve the double-free issue, while separate attention is needed for addressing the cursor-accounting concern.

References