CVE-2026-31787 Details
Description
In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace does a partial munmap() on a privcmd mapping, the kernel splits the VMA via __split_vma(). Since may_split is NULL, the split is allowed. vm_area_dup() copies vm_private_data (a pages array allocated in alloc_empty_pages()) into the new VMA without any fixup, because there is no .open callback. Both VMAs now point to the same pages array. When the unmapped portion is closed, privcmd_close() calls: - xen_unmap_domain_gfn_range() - xen_free_unpopulated_pages() - kvfree(pages) The surviving VMA still holds the dangling pointer. When it is later destroyed, the same sequence runs again, which leads to a double free. Fix this issue by adding a .may_split callback denying the VMA split. This is XSA-487 / CVE-2026-31787
A double free vulnerability has been identified in the Linux kernel's privcmd driver, which is used in Xen virtualization. This issue arises because the privcmd_vm_ops structure does not properly manage virtual memory area (VMA) operations. When userspace partially unmaps a privcmd mapping, the kernel splits the VMA, allowing both resulting VMAs to point to the same private data array. This duplication leads to a double free when the VMAs are closed and destroyed. The vulnerability affects Linux domains running on Xen, from kernel version 3.8 onwards.
Users can apply the patch included in the Xen Security Advisory XSA-487 to address this vulnerability. The patch is available in the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/1576ff3869cbd3620717195f971c85b7d7fd62b5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/24daca4fc07f3ff8cd0e3f629cd982187f48436a | kernel.org | Patch |
| https://git.kernel.org/stable/c/2894a351fe2ea8684919d36df3188b9a35e3926f | kernel.org | Patch |
| https://git.kernel.org/stable/c/2b985d3a024b9e8c24e21671b34e855569763808 | kernel.org | Patch |
| https://git.kernel.org/stable/c/402d84ad9e89bd4cbfd07ca8598532b7021daf95 | kernel.org | Patch |
| https://git.kernel.org/stable/c/446ee446d9ae66f36e95c3c90bbcc4e56b94cde0 | kernel.org | Patch |
| https://git.kernel.org/stable/c/71bf829800758a6e3889096e4754ef47ba7fc850 | kernel.org | Patch |
| https://git.kernel.org/stable/c/dbf862ce9f009128ab86b234d91413a3e450beb4 | kernel.org | Patch |
| http://www.openwall.com/lists/oss-security/2026/04/28/14 | CVE | Mailing ListThird Party Advisory |
| http://xenbits.xen.org/xsa/advisory-487.html | CVE | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-415 | Double Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 3.8, < 5.10.254 >= 5.11, < 5.15.204 >= 5.16, < 6.1.170 >= 6.2, < 6.6.137 >= 6.7, < 6.12.85 >= 6.13, < 6.18.26 >= 6.19, < 7.0.3 7.1 rc1 7.1 rc2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 6, 2026 | Initial Analysis | [email protected] |
| May 4, 2026 | CVE Modified | kernel.org |
| Apr 30, 2026 | New CVE Received | kernel.org |
| Apr 30, 2026 | CVE Modified | CVE |