In the Linux kernel, the following vulnerability has been resolved:
xen/privcmd: fix double free via VMA splitting
privcmd_vm_ops defines .close (privcmd_close), but neither .may_split
nor .open. When userspace does a partial munmap() on a privcmd mapping,
the kernel splits the VMA via __split_vma(). Since may_split is NULL,
the split is allowed. vm_area_dup() copies vm_private_data (a pages
array allocated in alloc_empty_pages()) into the new VMA without any
fixup, because there is no .open callback.
Both VMAs now point to the same pages array. When the unmapped portion
is closed, privcmd_close() calls:
- xen_unmap_domain_gfn_range()
- xen_free_unpopulated_pages()
- kvfree(pages)
The surviving VMA still holds the dangling pointer. When it is later
destroyed, the same sequence runs again, which leads to a double free.
Fix this issue by adding a .may_split callback denying the VMA split.
This is XSA-487 / CVE-2026-31787
References
Configurations
Configuration 1 (hide)
|
History
06 May 2026, 19:38
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* |
|
| CWE | CWE-415 | |
| First Time |
Linux
Linux linux Kernel |
|
| References | () https://git.kernel.org/stable/c/1576ff3869cbd3620717195f971c85b7d7fd62b5 - Patch | |
| References | () https://git.kernel.org/stable/c/24daca4fc07f3ff8cd0e3f629cd982187f48436a - Patch | |
| References | () https://git.kernel.org/stable/c/2894a351fe2ea8684919d36df3188b9a35e3926f - Patch | |
| References | () https://git.kernel.org/stable/c/2b985d3a024b9e8c24e21671b34e855569763808 - Patch | |
| References | () https://git.kernel.org/stable/c/402d84ad9e89bd4cbfd07ca8598532b7021daf95 - Patch | |
| References | () https://git.kernel.org/stable/c/446ee446d9ae66f36e95c3c90bbcc4e56b94cde0 - Patch | |
| References | () https://git.kernel.org/stable/c/71bf829800758a6e3889096e4754ef47ba7fc850 - Patch | |
| References | () https://git.kernel.org/stable/c/dbf862ce9f009128ab86b234d91413a3e450beb4 - Patch | |
| References | () http://www.openwall.com/lists/oss-security/2026/04/28/14 - Mailing List, Third Party Advisory | |
| References | () http://xenbits.xen.org/xsa/advisory-487.html - Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
04 May 2026, 09:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
30 Apr 2026, 17:11
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-30 11:16
Updated : 2026-05-06 19:38
NVD link : CVE-2026-31787
Mitre link : CVE-2026-31787
CVE.ORG link : CVE-2026-31787
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-415
Double Free