CVE-2026-74631

net: smc: fix splice entry lifetime imbalance in smc_rx_splice

Published Aug 22, 2026 CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

net: smc: fix splice entry lifetime imbalance in smc_rx_splice

smc_rx_splice() passes pages to splice_to_pipe() before taking the
references that cover the lifetime of each splice entry. In the
VM-backed RMB path, splice_to_pipe() may drop unqueued entries through
smc_rx_spd_release(), while queued entries are released later via the
pipe buffer callback.

The old post-splice accounting also derives the number of queued VM pages
from an offset mutated while building the descriptor, and a multi-page
splice pairs one sock_hold() with multiple sock_put() calls.

Take the page and socket references for every candidate entry before
splice_to_pipe(), and drop the matching private state, page reference,
and socket reference from smc_rx_spd_release() for entries that never
get queued. This fixes a refcount imbalance that can underflow page
refcounts and trigger a use-after-free.

Analysis

Technical impact

The Linux kernel’s smc_rx_splice routine previously passed page references to splice_to_pipe before ensuring that those references were retained, causing a refcount imbalance that can underflow page refcounts and lead to a use‑after‑free state. This flaw may result in unintended kernel memory access or instability.

Affected Systems

All Linux kernel installations for which the smc_rx_splice function is compiled and in use prior to the commit that adds the safety checks. The fix is present in newer kernel releases, but the specific version range is not listed in the advisory.

Risk and Exploitability

The CVSS score of 8.4 classifies this issue as high severity. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in KEV, meaning no publicly known exploitation to date. The likely attack vector is a remote network attacker targeting the SMC networking path, but this is inferred because the advisory does not explicitly state the vector. A use‑after‑free in the kernel can destabilize the system, so immediate patching is recommended to mitigate the risk.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< 7ddc7af2ae7fc5a0c0635b245c0824c8b76de5cb
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< 07ad246529d136d5ef441d5ab4c305d132ff3090
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< c841789e456ec6751342fa800639ce8e82ff0e6b
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< af02c67ce654356c58db20a0bb2db33ace3b07a8
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< ca8342b5fc24c249fdb998468f6a168b457c67e5
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< 0b7d54cedea5cb158e21925ae0c6c2f5c87ed2a0
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< 4515c78f4d9fd577270f012efeb062ea58b3682d
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< 5d9686af2976741bbd79b150d1c9e60b81e7f12e

Linux

affected

Version	Status	Constraints
`4.18`	affected	—
`0`	unaffected	< 4.18
`5.10.266`	unaffected	≤ 5.10.*
`5.15.217`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,c841789e456ec6751342fa800639ce8e82ff0e6b)`	affected	code_commit	—
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,af02c67ce654356c58db20a0bb2db33ace3b07a8)`	affected	code_commit	—
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,ca8342b5fc24c249fdb998468f6a168b457c67e5)`	affected	code_commit	—
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,0b7d54cedea5cb158e21925ae0c6c2f5c87ed2a0)`	affected	code_commit	—
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,4515c78f4d9fd577270f012efeb062ea58b3682d)`	affected	code_commit	—
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,5d9686af2976741bbd79b150d1c9e60b81e7f12e)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.18`	affected	generic	—
`[0,4.18)`	unaffected	generic	—
`[6.1.183,6.2.0)`	unaffected	generic	—
`[6.6.152,6.7.0)`	unaffected	generic	—
`[6.12.104,6.13.0)`	unaffected	generic	—
`[6.18.45,6.19.0)`	unaffected	generic	—
`[7.1.9,7.2.0)`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest available Linux kernel update that incorporates the smc_rx_splice fix, ensuring that the updated patch level is installed.
Reboot the machine after updating the kernel so that the patched code is loaded into execution.
Verify that all services that rely on the SMC networking path are restarted correctly and monitor dmesg or journal logs for any lingering reference‑count or memory‑corruption messages. If an immediate kernel upgrade is not possible, consider disabling or reconfiguring the SMC network interfaces until the patch can be applied.

Generated by OpenCVE AI on August 25, 2026 at 13:40 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Debian DSA	DSA-6466-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.138% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/07ad246529d136d5ef441d5ab4c305d132ff3090
https://git.kernel.org/stable/c/0b7d54cedea5cb158e21925ae0c6c2f5c87ed2a0
https://git.kernel.org/stable/c/4515c78f4d9fd577270f012efeb062ea58b3682d
https://git.kernel.org/stable/c/5d9686af2976741bbd79b150d1c9e60b81e7f12e
https://git.kernel.org/stable/c/7ddc7af2ae7fc5a0c0635b245c0824c8b76de5cb
https://git.kernel.org/stable/c/af02c67ce654356c58db20a0bb2db33ace3b07a8
https://git.kernel.org/stable/c/c841789e456ec6751342fa800639ce8e82ff0e6b
https://git.kernel.org/stable/c/ca8342b5fc24c249fdb998468f6a168b457c67e5
https://lore.kernel.org/linux-cve-announce/2026082221-CVE-2026-74631-4134@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74631
https://www.cve.org/CVERecord?id=CVE-2026-74631

History

Oct 17, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 25, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026082221-CVE-2026-74631-4134@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74631 https://www.cve.org/CVERecord?id=CVE-2026-74631
Metrics	threat_severity `None`	threat_severity `Moderate`

Aug 25, 2026 10:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Aug 25, 2026 8:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-416

Aug 25, 2026 6:00 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Aug 23, 2026 1:15 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/07ad246529d136d5ef441d5ab4c305d132ff3090 https://git.kernel.org/stable/c/7ddc7af2ae7fc5a0c0635b245c0824c8b76de5cb

Aug 22, 2026 7:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Aug 22, 2026 3:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smc_rx_splice smc_rx_splice() passes pages to splice_to_pipe() before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splice_to_pipe() may drop unqueued entries through smc_rx_spd_release(), while queued entries are released later via the pipe buffer callback. The old post-splice accounting also derives the number of queued VM pages from an offset mutated while building the descriptor, and a multi-page splice pairs one sock_hold() with multiple sock_put() calls. Take the page and socket references for every candidate entry before splice_to_pipe(), and drop the matching private state, page reference, and socket reference from smc_rx_spd_release() for entries that never get queued. This fixes a refcount imbalance that can underflow page refcounts and trigger a use-after-free.
Title		net: smc: fix splice entry lifetime imbalance in smc_rx_splice
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b7d54cedea5cb158e21925ae0c6c2f5c87ed2a0 https://git.kernel.org/stable/c/4515c78f4d9fd577270f012efeb062ea58b3682d https://git.kernel.org/stable/c/5d9686af2976741bbd79b150d1c9e60b81e7f12e https://git.kernel.org/stable/c/af02c67ce654356c58db20a0bb2db33ace3b07a8 https://git.kernel.org/stable/c/c841789e456ec6751342fa800639ce8e82ff0e6b https://git.kernel.org/stable/c/ca8342b5fc24c249fdb998468f6a168b457c67e5