net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer

...

SUSE CVE-2026-31507

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smcspdpriv when tee duplicates splice pipe buffer smcrxsplice allocates one smcspdpriv per pipebuffer and stores the pointer in pipebuffer.private. The pipebufoperations for these buffers used .get =...

PT-2026-34412

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smc spd priv when tee duplicates splice pipe buffer smc rx splice allocates one smc spd priv per pipe buffer and stores the pointer in pipe buffer.private. The pipe buf operations for these buffers use...