CVE-2026-74631
Received Received - Intake

Linux Kernel SMC splice Entry Lifetime Imbalance

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smc_rx_splice smc_rx_splice() passes pages to splice_to_pipe() before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splice_to_pipe() may drop unqueued entries through smc_rx_spd_release(), while queued entries are released later via the pipe buffer callback. The old post-splice accounting also derives the number of queued VM pages from an offset mutated while building the descriptor, and a multi-page splice pairs one sock_hold() with multiple sock_put() calls. Take the page and socket references for every candidate entry before splice_to_pipe(), and drop the matching private state, page reference, and socket reference from smc_rx_spd_release() for entries that never get queued. This fixes a refcount imbalance that can underflow page refcounts and trigger a use-after-free.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74631
EUVD
EUVD-2026-64568

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's SMC (Socket Messaging Channel) module. It involves a reference count imbalance in the smc_rx_splice function where page and socket references are not properly managed during splice operations. This can lead to underflow of page refcounts and trigger use-after-free conditions.

Detection Guidance

This vulnerability is specific to the Linux kernel's SMC (Socket Direct) implementation and may not have direct detection commands. Monitor kernel logs for errors related to smc_rx_splice or splice operations. Check for unexpected page refcount underflows or use-after-free errors in system logs.

Impact Analysis

This vulnerability could cause system instability, crashes, or security issues due to use-after-free conditions. Attackers might exploit it to execute arbitrary code or escalate privileges on affected systems running vulnerable Linux kernel versions.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-74631. If immediate patching is not possible, consider disabling SMC (Socket Direct) functionality if not required, as this vulnerability is specific to SMC operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74631. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart