CVE-2026-74631 - Vulnerability Details

- net: smc: fix splice entry lifetime imbalance in smc_rx_splice

Description

In the Linux kernel, the following vulnerability has been resolved:

net: smc: fix splice entry lifetime imbalance in smc_rx_splice

smc_rx_splice() passes pages to splice_to_pipe() before taking the
references that cover the lifetime of each splice entry. In the
VM-backed RMB path, splice_to_pipe() may drop unqueued entries through
smc_rx_spd_release(), while queued entries are released later via the
pipe buffer callback.

The old post-splice accounting also derives the number of queued VM pages
from an offset mutated while building the descriptor, and a multi-page
splice pairs one sock_hold() with multiple sock_put() calls.

Take the page and socket references for every candidate entry before
splice_to_pipe(), and drop the matching private state, page reference,
and socket reference from smc_rx_spd_release() for entries that never
get queued. This fixes a refcount imbalance that can underflow page
refcounts and trigger a use-after-free.

Published: 2026-08-22

Score: 8.4 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s smc_rx_splice routine previously passed page references to splice_to_pipe before ensuring that those references were retained, causing a refcount imbalance that can underflow page refcounts and lead to a use‑after‑free state. This flaw may result in unintended kernel memory access or instability.

Affected Systems

All Linux kernel installations for which the smc_rx_splice function is compiled and in use prior to the commit that adds the safety checks. The fix is present in newer kernel releases, but the specific version range is not listed in the advisory.

Risk and Exploitability

The CVSS score of 8.4 classifies this issue as high severity. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in KEV, meaning no publicly known exploitation to date. The likely attack vector is a remote network attacker targeting the SMC networking path, but this is inferred because the advisory does not explicitly state the vector. A use‑after‑free in the kernel can destabilize the system, so immediate patching is recommended to mitigate the risk.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< 7ddc7af2ae7fc5a0c0635b245c0824c8b76de5cb
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< 07ad246529d136d5ef441d5ab4c305d132ff3090
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< c841789e456ec6751342fa800639ce8e82ff0e6b
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< af02c67ce654356c58db20a0bb2db33ace3b07a8
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< ca8342b5fc24c249fdb998468f6a168b457c67e5
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< 0b7d54cedea5cb158e21925ae0c6c2f5c87ed2a0
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< 4515c78f4d9fd577270f012efeb062ea58b3682d
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< 5d9686af2976741bbd79b150d1c9e60b81e7f12e

Linux

affected

Version	Status	Constraints
`4.18`	affected	—
`0`	unaffected	< 4.18
`5.10.266`	unaffected	≤ 5.10.*
`5.15.217`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,c841789e456ec6751342fa800639ce8e82ff0e6b)`	affected	code_commit	—
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,af02c67ce654356c58db20a0bb2db33ace3b07a8)`	affected	code_commit	—
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,ca8342b5fc24c249fdb998468f6a168b457c67e5)`	affected	code_commit	—
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,0b7d54cedea5cb158e21925ae0c6c2f5c87ed2a0)`	affected	code_commit	—
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,4515c78f4d9fd577270f012efeb062ea58b3682d)`	affected	code_commit	—
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,5d9686af2976741bbd79b150d1c9e60b81e7f12e)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.18`	affected	generic	—
`[0,4.18)`	unaffected	generic	—
`[6.1.183,6.2.0)`	unaffected	generic	—
`[6.6.152,6.7.0)`	unaffected	generic	—
`[6.12.104,6.13.0)`	unaffected	generic	—
`[6.18.45,6.19.0)`	unaffected	generic	—
`[7.1.9,7.2.0)`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest available Linux kernel update that incorporates the smc_rx_splice fix, ensuring that the updated patch level is installed.
Reboot the machine after updating the kernel so that the patched code is loaded into execution.
Verify that all services that rely on the SMC networking path are restarted correctly and monitor dmesg or journal logs for any lingering reference‑count or memory‑corruption messages. If an immediate kernel upgrade is not possible, consider disabling or reconfiguring the SMC network interfaces until the patch can be applied.

Generated by OpenCVE AI on August 25, 2026 at 13:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00138.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/07ad246529d136d5ef441d5ab4c305d132ff3090
https://git.kernel.org/stable/c/0b7d54cedea5cb158e21925ae0c6c2f5c87ed2a0
https://git.kernel.org/stable/c/4515c78f4d9fd577270f012efeb062ea58b3682d
https://git.kernel.org/stable/c/5d9686af2976741bbd79b150d1c9e60b81e7f12e
https://git.kernel.org/stable/c/7ddc7af2ae7fc5a0c0635b245c0824c8b76de5cb
https://git.kernel.org/stable/c/af02c67ce654356c58db20a0bb2db33ace3b07a8
https://git.kernel.org/stable/c/c841789e456ec6751342fa800639ce8e82ff0e6b
https://git.kernel.org/stable/c/ca8342b5fc24c249fdb998468f6a168b457c67e5
https://lore.kernel.org/linux-cve-announce/2026082221-CVE-2026-74631-4134@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74631
https://www.cve.org/CVERecord?id=CVE-2026-74631

History

Tue, 25 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026082221-CVE-2026-74631-4134@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74631 https://www.cve.org/CVERecord?id=CVE-2026-74631
Metrics	threat_severity `None`	threat_severity `Moderate`

Tue, 25 Aug 2026 10:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Tue, 25 Aug 2026 08:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Tue, 25 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 23 Aug 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/07ad246529d136d5ef441d5ab4c305d132ff3090 https://git.kernel.org/stable/c/7ddc7af2ae7fc5a0c0635b245c0824c8b76de5cb

Sat, 22 Aug 2026 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 22 Aug 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smc_rx_splice smc_rx_splice() passes pages to splice_to_pipe() before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splice_to_pipe() may drop unqueued entries through smc_rx_spd_release(), while queued entries are released later via the pipe buffer callback. The old post-splice accounting also derives the number of queued VM pages from an offset mutated while building the descriptor, and a multi-page splice pairs one sock_hold() with multiple sock_put() calls. Take the page and socket references for every candidate entry before splice_to_pipe(), and drop the matching private state, page reference, and socket reference from smc_rx_spd_release() for entries that never get queued. This fixes a refcount imbalance that can underflow page refcounts and trigger a use-after-free.
Title		net: smc: fix splice entry lifetime imbalance in smc_rx_splice
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b7d54cedea5cb158e21925ae0c6c2f5c87ed2a0 https://git.kernel.org/stable/c/4515c78f4d9fd577270f012efeb062ea58b3682d https://git.kernel.org/stable/c/5d9686af2976741bbd79b150d1c9e60b81e7f12e https://git.kernel.org/stable/c/af02c67ce654356c58db20a0bb2db33ace3b07a8 https://git.kernel.org/stable/c/c841789e456ec6751342fa800639ce8e82ff0e6b https://git.kernel.org/stable/c/ca8342b5fc24c249fdb998468f6a168b457c67e5

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-22T15:32:12.334Z

Updated: 2026-08-25T05:40:55.722Z

Reserved: 2026-08-15T05:44:03.922Z

Link: CVE-2026-74631

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-22T16:16:36.080

Modified: 2026-08-25T06:18:42.167

Link: CVE-2026-74631

Redhat

Severity : Moderate

Publid Date: 2026-08-22T00:00:00Z

Links: CVE-2026-74631 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-25T13:45:04Z

Weaknesses

CWE-416
Use After Free
CWE-911
Improper Update of Reference Count

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object