CVE-2026-31787: xen/privcmd: fix double free via VMA splitting
Vulnerability summary
CVE-2026-31787 is a high (CVSS 7.8) Double Free vulnerability in linux. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.9% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 17 · Related 5Timeline
- 30-04-2026PublishedVulnerability first disclosed.
- 14-06-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace does a partial munmap() on a privcmd mapping, the kernel splits the VMA via __split_vma(). Since may_split is NULL, the split is allowed. vm_area_dup() copies vm_private_data (a pages array allocated in alloc_empty_pages()) into the new VMA without any fixup, because there is no .open callback. Both VMAs now point to the same pages array. When the unmapped portion is closed, privcmd_close() calls: - xen_unmap_domain_gfn_range() - xen_free_unpopulated_pages() - kvfree(pages) The surviving VMA still holds the dangling pointer. When it is later destroyed, the same sequence runs again, which leads to a double free. Fix this issue by adding a .may_split callback denying the VMA split. This is XSA-487 / CVE-2026-31787
CVSS metrics
4 scores · 4 sources · 1 version- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.18%
Chance of exploitation in the next 30 days
Percentile
8%
Versus all other CVEs
30-day change
Decrease -0.01 pp
From 0.19% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu169 products
- linuxAll versions (No fix recorded) | < 5.15.0-186.196 | < 6.8.0-136.136 | < 7.0.0-27.27
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1112.119 | < 6.8.0-1061.64 | < 7.0.0-1008.8
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Chainguard11 products
- linux-aws-6.12< 6.12.85-r2
- linux-aws-6.18< 6.18.31-r0
- linux-azure-6.12< 6.12.85-r2
- linux-azure-6.18< 6.18.24-r1 | < 6.18.31-r0
- linux-gcp-6.12< 6.12.89-r0
Linux2 products
- linux≥ d71f513985c22f1050295d1a7e4327cf9fb060da, < dbf862ce9f009128ab86b234d91413a3e450beb4 | ≥ d71f513985c22f1050295d1a7e4327cf9fb060da, < 2b985d3a024b9e8c24e21671b34e855569763808 | ≥ d71f513985c22f1050295d1a7e4327cf9fb060da, < 1576ff3869cbd3620717195f971c85b7d7fd62b5 | ≥ d71f513985c22f1050295d1a7e4327cf9fb060da, < 402d84ad9e89bd4cbfd07ca8598532b7021daf95 | ≥ d71f513985c22f1050295d1a7e4327cf9fb060da, < 2894a351fe2ea8684919d36df3188b9a35e3926f | ≥ d71f513985c22f1050295d1a7e4327cf9fb060da, < 446ee446d9ae66f36e95c3c90bbcc4e56b94cde0 | ≥ d71f513985c22f1050295d1a7e4327cf9fb060da, < 71bf829800758a6e3889096e4754ef47ba7fc850 | ≥ d71f513985c22f1050295d1a7e4327cf9fb060da, < 24daca4fc07f3ff8cd0e3f629cd982187f48436a | 3.8
- linux_kernel≥ 3.8, < 5.10.254 | ≥ 5.11, < 5.15.204 | ≥ 5.16, < 6.1.170 | ≥ 6.2, < 6.6.137 | ≥ 6.7, < 6.12.85 | ≥ 6.13, < 6.18.26 | ≥ 6.19, < 7.0.3 | 7.1:rc1 | 7.1:rc2
Alpine1 product
- xenAll versions (No fix recorded)
Debian1 product
- linux< 6.1.170-1 | < 6.12.85-1 | < 7.0.3-1
5 vendors · 184 products
References
15 links- xenbits.xen.org/xsa/advisory-487.htmlThird Party Advisory
