CVE-2026-31507

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores the pointer in pipe_buffer.private. The pipe_buf_operations for these buffers used .get = generic_pipe_buf_get, which only increments the page reference count when tee(2) duplicates a pipe buffer. The smc_spd_priv pointer itself was not handled, so after tee() both the original and the cloned pipe_buffer share the same smc_spd_priv *. When both pipes are subsequently release...

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Affected versions

>= 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f < 7e8916f46c2f48607f907fd401590093753a6bc5, >= 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f < ae5575e660410c8d2c5d38fb28a0f37aea945676, >= 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f < 98ba5cb274768146e25ffbfde47753652c1c20d3, >= 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f < 81acbd345d405994875d419d43b319fee0b9ad62, >= 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f < 7bcb974c771c863e8588cea0012ac204443a7126, >= 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f < 54c87a730157868543ebdfa0ecb21b4590ed23a5, >= 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f < 3cc76380fea749280c026f410af56a28aaac388a, >= 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f < 24dd586bb4cbba1889a50abe74143817a095c1c9, >= 4.18, >= V3.1.6, >= V3.1.5, >= 4.18.1 < 5.10.253, >= 5.11 < 5.15.203, >= 5.16 < 6.1.168, >= 6.2 < 6.6.131, >= 6.7 < 6.12.80, >= 6.13 < 6.18.21, >= 6.19 < 6.19.11, 4.18, 7.0

Fixed versions

5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-415