CVE-2026-31787
Description
In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace does a partial munmap() on a privcmd mapping, the kernel splits the VMA via __split_vma(). Since may_split is NULL, the split is allowed. vm_area_dup() copies vm_private_data (a pages array allocated in alloc_empty_pages()) into the new VMA without any fixup, because there is no .open callback. Both VMAs now point to the same pages array. When the unmapped portion is closed, privcmd_close() calls: - xen_unmap_domain_gfn_range() - xen_free_unpopulated_pages() - kvfree(pages) The surviving VMA still holds the dangling pointer. When it is later destroyed, the same sequence runs again, which leads to a double free. Fix this issue by adding a .may_split callback denying the VMA split. This is XSA-487 / CVE-2026-31787
How to fix
- linux linux_kernel5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.26, 7.0.3 or later
- git.kernel.org/stable/c/1576ff3869cbd3620717195f971c85b7d7fd62b5
- git.kernel.org/stable/c/24daca4fc07f3ff8cd0e3f629cd982187f48436a
- git.kernel.org/stable/c/2894a351fe2ea8684919d36df3188b9a35e3926f
- git.kernel.org/stable/c/2b985d3a024b9e8c24e21671b34e855569763808
- git.kernel.org/stable/c/402d84ad9e89bd4cbfd07ca8598532b7021daf95
- git.kernel.org/stable/c/446ee446d9ae66f36e95c3c90bbcc4e56b94cde0
- git.kernel.org/stable/c/71bf829800758a6e3889096e4754ef47ba7fc850
- git.kernel.org/stable/c/dbf862ce9f009128ab86b234d91413a3e450beb4
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 3.8 ≤ v < 5.10.254, 5.11 ≤ v < 5.15.204, 5.16 ≤ v < 6.1.170, 6.2 ≤ v < 6.6.137, 6.7 ≤ v < 6.12.85, 6.13 ≤ v < 6.18.26, 6.19 ≤ v < 7.0.3, 7.1 | 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.26, 7.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.