CVE-2026-74631
In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smc_rx_splice smc_rx_splice() passes pages to splice_to_pipe() before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splice_to_pipe() may drop unqueued entries through smc_rx_spd_release(), while queued entries are released later via the pipe buffer callback. The old post-splice accounting also derives the number of queued VM pages from an offset mutated while building the descriptor, and a multi-page splice pairs one sock_hold() with multiple sock_put() calls. Take the page and socket references for every candidate entry before splice_to_pipe(), and drop the matching private state, page reference, and socket reference from smc_rx_spd_release() for entries that never get queued. This fixes a refcount imbalance that can underflow page refcounts and trigger a use-after-free.
Affected versions
Linux kernel versions
4.18
and later are affected. Fixed in
6.1.183,
6.6.152,
6.12.104,
6.18.45,
7.1.9,
7.2
and their respective stable series.
References
6 totalFrequently asked questions
-
What is CVE-2026-74631?
CVE-2026-74631 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.18 onward and has been patched in 6.1.183, 6.6.152, 6.12.104 and others. CVE-2026-74631 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-74631?
Yes. CVE-2026-74631 has been patched. Fixed versions include 6.1.183, 6.6.152, 6.12.104 and others. If you are running Linux kernel 4.18 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-74631 actively exploited?
No. CVE-2026-74631 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.