CVE-2026-31507

CVE-2026-31507 affects the Linux kernel SMC module (net/smc). The vulnerability is a double-free of the per-buffer state (smc_spd_priv) when tee(2) duplicates a splice pipe buffer, leading to a use-after-free and a kernel NULL pointer dereference, ultimately causing a kernel panic. The root cause...

PT-2026-34412

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smc spd priv when tee duplicates splice pipe buffer smc rx splice allocates one smc spd priv per pipe buffer and stores the pointer in pipe buffer.private. The pipe buf operations for these buffers use...