The Linux kernel has a double‑free flaw in the xen/privcmd virtual memory area handling. When a userspace process performs a partial munmap() on a privcmd mapping, the kernel splits the VMA, duplicating a pages array without proper cleanup. The original and split VMAs both reference the same array, and each VMA’s close handler frees the array, causing a double free. This kernel‑level memory corruption can be leveraged by an attacker. Based on the description, it is inferred that an attacker could potentially execute arbitrary code with elevated privileges, leading to full control over the system. The vulnerability also creates a denial‑of‑service avenue through kernel crashes or OOM conditions.

All Linux kernel releases that include the xen/privcmd module before the patch addressing XSA‑487 (CVE‑2026‑31787) are affected. No specific version range is supplied; the fix applies to any kernel embedding the vulnerable code path.

The risk is high because the flaw occurs in kernel memory management and can be triggered by any user able to create a privcmd mapping. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the severity is effectively high due to the potential for arbitrary code execution. Based on the description, it is inferred that an attacker does not need advanced privileges to exploit the underlying code, though the exact attack surface (e.g., whether privileged processes exclusively create privcmd mappings) is not detailed in the description. The lack of a user‑controllable .may_split callback allows the split to proceed unconditionally, making the exploit path straightforward once the vulnerable mapping exists.