{"id":"CVE-2026-31787","title":"xen/privcmd: fix double free via VMA splitting","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen/privcmd: fix double free via VMA splitting\n\nprivcmd_vm_ops defines .close (privcmd_close), but neither .may_split\nnor .open. When userspace does a partial munmap() …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= d71f513985c22f1050295d1a7e4327cf9fb060da < dbf862ce9f009128ab86b234d91413a3e450beb4","Linux >= d71f513985c22f1050295d1a7e4327cf9fb060da < 2b985d3a024b9e8c24e21671b34e855569763808","Linux >= d71f513985c22f1050295d1a7e4327cf9fb060da < 1576ff3869cbd3620717195f971c85b7d7fd62b5","Linux >= d71f513985c22f1050295d1a7e4327cf9fb060da < 402d84ad9e89bd4cbfd07ca8598532b7021daf95","Linux >= d71f513985c22f1050295d1a7e4327cf9fb060da < 2894a351fe2ea8684919d36df3188b9a35e3926f","Linux >= d71f513985c22f1050295d1a7e4327cf9fb060da < 446ee446d9ae66f36e95c3c90bbcc4e56b94cde0","Linux >= d71f513985c22f1050295d1a7e4327cf9fb060da < 71bf829800758a6e3889096e4754ef47ba7fc850","Linux >= d71f513985c22f1050295d1a7e4327cf9fb060da < 24daca4fc07f3ff8cd0e3f629cd982187f48436a","Linux 3.8"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:25:39.751360Z"},"exploitAvailable":true,"published":"2026-04-30","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:32:25.719Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31787","references":[{"url":"https://git.kernel.org/stable/c/dbf862ce9f009128ab86b234d91413a3e450beb4"},{"url":"https://git.kernel.org/stable/c/2b985d3a024b9e8c24e21671b34e855569763808"},{"url":"https://git.kernel.org/stable/c/1576ff3869cbd3620717195f971c85b7d7fd62b5"},{"url":"https://git.kernel.org/stable/c/402d84ad9e89bd4cbfd07ca8598532b7021daf95"},{"url":"https://git.kernel.org/stable/c/2894a351fe2ea8684919d36df3188b9a35e3926f"},{"url":"https://git.kernel.org/stable/c/446ee446d9ae66f36e95c3c90bbcc4e56b94cde0"},{"url":"https://git.kernel.org/stable/c/71bf829800758a6e3889096e4754ef47ba7fc850"},{"url":"https://git.kernel.org/stable/c/24daca4fc07f3ff8cd0e3f629cd982187f48436a"}],"tags":["cve.org","exploit-available"],"epss":0.00183,"epssPercentile":0.07973,"exploits":{"github":1,"githubRepos":["https://github.com/0xAtharv/CVE-2026-31787"],"checkedAt":"2026-11-08T19:18:50.957Z"},"ingestedAt":"2026-11-06T15:54:04.041Z","slug":"CVE-2026-31787","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxen/privcmd: fix double free via VMA splitting\n\nprivcmd_vm_ops defines .close (privcmd_close), but neither .may_split\nnor .open. When userspace does a partial munmap() on a privcmd mapping,\nthe kernel splits the VMA via __split_vma(). Since may_split is NULL,\nthe split is allowed. vm_area_dup() copies vm_private_data (a pages\narray allocated in alloc_empty_pages()) into the new VMA without any\nfixup, because there is no .open callback.\n\nBoth VMAs now point to the same pages array. When the unmapped portion\nis closed, privcmd_close() calls:\n    - xen_unmap_domain_gfn_range()\n    - xen_free_unpopulated_pages()\n    - kvfree(pages)\n\nThe surviving VMA still holds the dangling pointer. When it is later\ndestroyed, the same sequence runs again, which leads to a double free.\n\nFix this issue by adding a .may_split callback denying the VMA split.\n\nThis is XSA-487 / CVE-2026-31787\n\n## Affected\n\n- `Linux >= d71f513985c22f1050295d1a7e4327cf9fb060da < dbf862ce9f009128ab86b234d91413a3e450beb4`\n- `Linux >= d71f513985c22f1050295d1a7e4327cf9fb060da < 2b985d3a024b9e8c24e21671b34e855569763808`\n- `Linux >= d71f513985c22f1050295d1a7e4327cf9fb060da < 1576ff3869cbd3620717195f971c85b7d7fd62b5`\n- `Linux >= d71f513985c22f1050295d1a7e4327cf9fb060da < 402d84ad9e89bd4cbfd07ca8598532b7021daf95`\n- `Linux >= d71f513985c22f1050295d1a7e4327cf9fb060da < 2894a351fe2ea8684919d36df3188b9a35e3926f`\n- `Linux >= d71f513985c22f1050295d1a7e4327cf9fb060da < 446ee446d9ae66f36e95c3c90bbcc4e56b94cde0`\n- `Linux >= d71f513985c22f1050295d1a7e4327cf9fb060da < 71bf829800758a6e3889096e4754ef47ba7fc850`\n- `Linux >= d71f513985c22f1050295d1a7e4327cf9fb060da < 24daca4fc07f3ff8cd0e3f629cd982187f48436a`\n- `Linux 3.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":15,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}