CVE-2026-74631 - Vulnerability Details

- net: smc: fix splice entry lifetime imbalance in smc_rx_splice

Description

In the Linux kernel, the following vulnerability has been resolved:

net: smc: fix splice entry lifetime imbalance in smc_rx_splice

smc_rx_splice() passes pages to splice_to_pipe() before taking the
references that cover the lifetime of each splice entry. In the
VM-backed RMB path, splice_to_pipe() may drop unqueued entries through
smc_rx_spd_release(), while queued entries are released later via the
pipe buffer callback.

The old post-splice accounting also derives the number of queued VM pages
from an offset mutated while building the descriptor, and a multi-page
splice pairs one sock_hold() with multiple sock_put() calls.

Take the page and socket references for every candidate entry before
splice_to_pipe(), and drop the matching private state, page reference,
and socket reference from smc_rx_spd_release() for entries that never
get queued. This fixes a refcount imbalance that can underflow page
refcounts and trigger a use-after-free.

Published: 2026-08-22

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s smc_rx_splice routine previously passed page references to splice_to_pipe before ensuring that those references were retained, causing a refcount imbalance that can underflow page refcounts and lead to a use‑after‑free state. This flaw may result in unintended kernel memory access or instability.

Affected Systems

All Linux kernel installations for which the smc_rx_splice function is compiled and in use prior to the commit that adds the safety checks. The fix is present in newer kernel releases, but the specific version range is not listed in the advisory.

Risk and Exploitability

A use‑after‑free in the kernel is a high‑severity issue that can destabilize the system. The EPSS score is not available, and the vulnerability is not listed in KEV, indicating no publicly known exploitation at this time. Immediate patching is recommended to mitigate the risk.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< c841789e456ec6751342fa800639ce8e82ff0e6b
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< af02c67ce654356c58db20a0bb2db33ace3b07a8
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< ca8342b5fc24c249fdb998468f6a168b457c67e5
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< 0b7d54cedea5cb158e21925ae0c6c2f5c87ed2a0
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< 4515c78f4d9fd577270f012efeb062ea58b3682d
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< 5d9686af2976741bbd79b150d1c9e60b81e7f12e

Linux

affected

Version	Status	Constraints
`4.18`	affected	—
`0`	unaffected	< 4.18
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,c841789e456ec6751342fa800639ce8e82ff0e6b)`	affected	code_commit	—
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,af02c67ce654356c58db20a0bb2db33ace3b07a8)`	affected	code_commit	—
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,ca8342b5fc24c249fdb998468f6a168b457c67e5)`	affected	code_commit	—
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,0b7d54cedea5cb158e21925ae0c6c2f5c87ed2a0)`	affected	code_commit	—
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,4515c78f4d9fd577270f012efeb062ea58b3682d)`	affected	code_commit	—
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,5d9686af2976741bbd79b150d1c9e60b81e7f12e)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.18`	affected	generic	—
`[0,4.18)`	unaffected	generic	—
`[6.1.183,6.2.0)`	unaffected	generic	—
`[6.6.152,6.7.0)`	unaffected	generic	—
`[6.12.104,6.13.0)`	unaffected	generic	—
`[6.18.45,6.19.0)`	unaffected	generic	—
`[7.1.9,7.2.0)`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest available Linux kernel update that incorporates the smc_rx_splice fix, ensuring that the updated patch level is installed.
Reboot the machine after updating the kernel so that the patched code is loaded into execution.
Verify that all services that rely on the SMC networking path are restarted correctly and monitor dmesg or journal logs for any lingering reference‑count or memory‑corruption messages. If an immediate kernel upgrade is not possible, consider disabling or reconfiguring the SMC network interfaces until the patch can be applied.

Generated by OpenCVE AI on August 22, 2026 at 18:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0b7d54cedea5cb158e21925ae0c6c2f5c87ed2a0
https://git.kernel.org/stable/c/4515c78f4d9fd577270f012efeb062ea58b3682d
https://git.kernel.org/stable/c/5d9686af2976741bbd79b150d1c9e60b81e7f12e
https://git.kernel.org/stable/c/af02c67ce654356c58db20a0bb2db33ace3b07a8
https://git.kernel.org/stable/c/c841789e456ec6751342fa800639ce8e82ff0e6b
https://git.kernel.org/stable/c/ca8342b5fc24c249fdb998468f6a168b457c67e5

History

Sat, 22 Aug 2026 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 22 Aug 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smc_rx_splice smc_rx_splice() passes pages to splice_to_pipe() before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splice_to_pipe() may drop unqueued entries through smc_rx_spd_release(), while queued entries are released later via the pipe buffer callback. The old post-splice accounting also derives the number of queued VM pages from an offset mutated while building the descriptor, and a multi-page splice pairs one sock_hold() with multiple sock_put() calls. Take the page and socket references for every candidate entry before splice_to_pipe(), and drop the matching private state, page reference, and socket reference from smc_rx_spd_release() for entries that never get queued. This fixes a refcount imbalance that can underflow page refcounts and trigger a use-after-free.
Title		net: smc: fix splice entry lifetime imbalance in smc_rx_splice
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b7d54cedea5cb158e21925ae0c6c2f5c87ed2a0 https://git.kernel.org/stable/c/4515c78f4d9fd577270f012efeb062ea58b3682d https://git.kernel.org/stable/c/5d9686af2976741bbd79b150d1c9e60b81e7f12e https://git.kernel.org/stable/c/af02c67ce654356c58db20a0bb2db33ace3b07a8 https://git.kernel.org/stable/c/c841789e456ec6751342fa800639ce8e82ff0e6b https://git.kernel.org/stable/c/ca8342b5fc24c249fdb998468f6a168b457c67e5

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-22T15:32:12.334Z

Updated: 2026-08-22T15:32:12.334Z

Reserved: 2026-08-15T05:44:03.922Z

Link: CVE-2026-74631

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-22T16:16:36.080

Modified: 2026-08-22T16:16:36.080

Link: CVE-2026-74631

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-22T19:30:17Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object