CVE-2026-31730

Modified Modified - Updated After Analysis

Double-Free in Linux Kernel FastRPC

Publication date: 2026-05-01

Last updated on: 2026-05-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: possible double-free of cctx->remote_heap fastrpc_init_create_static_process() may free cctx->remote_heap on the err_map path but does not clear the pointer. Later, fastrpc_rpmsg_remove() frees cctx->remote_heap again if it is non-NULL, which can lead to a double-free if the INIT_CREATE_STATIC ioctl hits the error path and the rpmsg device is subsequently removed/unbound. Clear cctx->remote_heap after freeing it in the error path to prevent the later cleanup from freeing it again. This issue was found by an in-house analysis workflow that extracts AST-based information and runs static checks, with LLM assistance for triage, and was confirmed by manual code review. No hardware testing was performed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-01

Last Modified

2026-05-08

Generated

2026-07-26

AI Q&A

2026-05-01

EPSS Evaluated

2026-07-25

NVD

CVE-2026-31730

EUVD

EUVD-2026-26543

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	From 6.13 (inc) to 6.18.22 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.12 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.81 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.134 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-415	The product calls free() twice on the same memory address.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's fastrpc component, where a double-free error can occur with the cctx->remote_heap pointer.

Specifically, the function fastrpc_init_create_static_process() may free the cctx->remote_heap pointer on an error path but does not clear the pointer afterward. Later, when fastrpc_rpmsg_remove() is called, it checks if cctx->remote_heap is non-NULL and frees it again, causing a double-free.

This double-free can happen if the INIT_CREATE_STATIC ioctl triggers the error path and the rpmsg device is later removed or unbound.

The fix involves clearing the cctx->remote_heap pointer after freeing it in the error path to prevent the second free.

Impact Analysis

This vulnerability in the Linux kernel involves a possible double-free of the cctx->remote_heap pointer in the fastrpc component. A double-free can lead to undefined behavior such as memory corruption, crashes, or potential exploitation by attackers to execute arbitrary code or cause denial of service.

Mitigation Strategies

The vulnerability involves a double-free issue in the Linux kernel's fastrpc component related to the cctx->remote_heap pointer.

To mitigate this vulnerability, you should update your Linux kernel to a version where this issue has been fixed. The fix involves clearing the cctx->remote_heap pointer after freeing it in the error path to prevent a double-free during later cleanup.

Hi! I’m here to help you understand CVE-2026-31730. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70