cve-2026-31507

CVE-2026-31507 is a Linux kernel vulnerability in the SMC (Shared Memory Communications) networking stack. The flaw involves a double-free of the smc_spd_priv structure when the tee() system call duplicates an SMC splice pipe buffer. In smc_rx_splice(), a private object is allocated per pipe buffer, but the clone path only increments the page reference count while leaving the private pointer shared. This leads to two pipe buffers attempting to release the same object, causing a use-after-free and eventually a kernel panic. The vulnerability can be triggered by a local attacker with the ability to issue splice and tee operations, potentially leading to system instability or denial of service.