CVE-2026-74631: Linux Kernel Use-After-Free Vulnerability

CVE-2026-74631 Overview

CVE-2026-74631 is a use-after-free vulnerability in the Linux kernel's Shared Memory Communications (SMC) subsystem. The flaw resides in smc_rx_splice(), which passes pages to splice_to_pipe() before acquiring the references required to cover each splice entry's lifetime. In the VM-backed Remote Memory Buffer (RMB) path, this ordering causes page and socket reference counting to diverge from actual entry ownership. Attackers with local access can underflow page refcounts and trigger a use-after-free, leading to memory corruption and potential kernel privilege escalation.

Critical Impact
A local attacker exploiting the refcount imbalance in smc_rx_splice() can trigger a use-after-free in the Linux kernel, enabling arbitrary kernel memory corruption with high impact to confidentiality, integrity, and availability.

Affected Products

Linux kernel builds containing the SMC subsystem with VM-backed RMB support prior to the fix commits
Distributions shipping affected mainline and stable kernel branches referenced in the kernel.org commits
Systems where the SMC protocol (AF_SMC) is loadable or enabled

Discovery Timeline

2026-08-22 - CVE-2026-74631 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74631

Vulnerability Analysis

The vulnerability affects smc_rx_splice() in the Linux kernel's SMC receive path. The function builds a splice descriptor and hands pages to splice_to_pipe() before taking the page and socket references intended to cover the lifetime of each splice pipe entry.

In the VM-backed RMB code path, splice_to_pipe() can drop unqueued entries by invoking smc_rx_spd_release(). Queued entries follow a different lifecycle and are released later through the pipe buffer callback. This asymmetric release path collides with the mis-ordered reference acquisition.

The legacy post-splice accounting compounds the issue. It derives the count of queued VM pages from an offset that is mutated during descriptor construction. A multi-page splice pairs a single sock_hold() with multiple sock_put() calls, driving the socket refcount below its true value.

Root Cause

The root cause is a lifetime imbalance between reference acquisition and release inside smc_rx_splice(). Pages enter splice_to_pipe() without the references that the release paths, smc_rx_spd_release() and the pipe buffer callback, later drop. Combined with offset-based accounting mutated mid-build, this produces refcount underflow on both struct page objects and the owning socket, which is the precondition for a use-after-free [CWE-416].

Attack Vector

Exploitation requires local access and the ability to open an SMC socket and invoke splice()-family syscalls against its receive queue. An attacker crafts multi-page receive operations against a VM-backed RMB to force the imbalance, driving the page refcount to zero prematurely. Freed pages can then be reallocated and reused while the pipe still references them, giving the attacker a use-after-free primitive against kernel memory.

The vulnerability is described in the upstream Linux kernel commits, including Kernel Git Commit 07ad246 and Kernel Git Commit ca8342b5. No public proof-of-concept exploit is available.

Detection Methods for CVE-2026-74631

Indicators of Compromise

Kernel oops or panic messages referencing smc_rx_splice, splice_to_pipe, or smc_rx_spd_release in dmesg and /var/log/kern.log
refcount_t: underflow or BUG: KASAN: use-after-free warnings tied to page or socket structures in the SMC receive path
Unexpected process crashes or kernel instability on hosts using SMC-R or SMC-D transports

Detection Strategies

Enable KASAN on test kernels to catch use-after-free conditions in the SMC receive path during fuzzing
Audit running kernels with uname -r and compare against fixed versions listed in the kernel.org stable commits
Monitor whether the smc module is loaded (lsmod | grep smc) on systems that do not require SMC, since exposure is limited when the module is absent

Monitoring Recommendations

Forward kernel logs to a centralized logging pipeline and alert on refcount, KASAN, and general protection fault signatures involving SMC symbols
Track local privilege escalation indicators such as unexpected UID transitions and new SUID processes on Linux hosts running affected kernels
Baseline usage of the AF_SMC address family and flag unauthorized processes opening SMC sockets

How to Mitigate CVE-2026-74631

Immediate Actions Required

Apply vendor kernel updates containing the upstream fix commits as soon as they are available for your distribution
Inventory Linux hosts using SMC-R or SMC-D and prioritize patching for shared or multi-tenant systems
Restrict local shell access on affected hosts until patches are deployed, since the attack vector is local

Patch Information

The fix takes page and socket references for every candidate entry before calling splice_to_pipe(), and drops the matching private state, page reference, and socket reference from smc_rx_spd_release() for entries that never get queued. This aligns acquisition and release across both the unqueued and queued paths. Patches are available in the upstream stable tree via Kernel Git Commit 07ad246, Kernel Git Commit 0b7d54c, Kernel Git Commit 4515c78, Kernel Git Commit 5d9686a, Kernel Git Commit 7ddc7af, Kernel Git Commit af02c67, Kernel Git Commit c841789, and Kernel Git Commit ca8342b5.

Workarounds

Blacklist the smc module on systems that do not use SMC-R or SMC-D by adding install smc /bin/true to /etc/modprobe.d/ configuration
Disable autoloading of the AF_SMC address family by restricting CAP_SYS_MODULE and unprivileged module loading
Limit local user access and enforce least privilege to reduce the population of accounts able to open SMC sockets

bash

# Configuration example
# Prevent the vulnerable SMC module from loading
echo 'install smc /bin/true' | sudo tee /etc/modprobe.d/disable-smc.conf
sudo rmmod smc 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep -E '^smc'

# Confirm kernel version after patching
uname -r