CVE-2026-74631 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
net: smc: fix splice entry lifetime imbalance in smc_rx_splice
smc_rx_splice() passes pages to splice_to_pipe() before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splice_to_pipe() may drop unqueued entries through smc_rx_spd_release(), while queued entries are released later via the pipe buffer callback.
The old post-splice accounting also derives the number of queued VM pages from an offset mutated while building the descriptor, and a multi-page splice pairs one sock_hold() with multiple sock_put() calls.
Take the page and socket references for every candidate entry before splice_to_pipe(), and drop the matching private state, page reference, and socket reference from smc_rx_spd_release() for entries that never get queued. This fixes a refcount imbalance that can underflow page refcounts and trigger a use-after-free.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/23/2026
The vulnerability identified in the Linux kernel's SMC (Shared Memory Communications) subsystem involves a critical reference counting error within the smc_rx_splice function, which handles data transfer via splice operations for receive buffers backed by virtual memory. This flaw stems from an incorrect ordering of resource acquisition and release during the processing of splice entries. Specifically, the code passes pages to the splice_to_pipe() helper before securing the necessary references that dictate the lifetime of each splice entry. In scenarios involving VM-backed Receive Memory Buffers (RMB), this sequence creates a race condition where splice_to_pipe may discard unqueued entries by invoking smc_rx_spd_release prematurely. Meanwhile, queued entries are scheduled for release later through standard pipe buffer callbacks, leading to an inconsistent state regarding resource ownership and lifecycle management.
The technical root cause is further exacerbated by flawed accounting logic that determines the number of queued virtual memory pages based on an offset value modified during descriptor construction. This approach results in a multi-page splice operation where a single sock_hold call is incorrectly paired with multiple sock_put calls for the same socket instance. Such a mismatch causes reference count underflows, which can lead to premature deallocation of kernel objects. When these objects are freed while still being referenced or accessed by other parts of the networking stack, it triggers use-after-free conditions that compromise memory safety and system stability.
From an operational impact perspective, this vulnerability allows for potential denial of service through kernel crashes or panics due to invalid memory accesses. In more severe cases, if an attacker can influence the splice operations or trigger specific network traffic patterns, they might exploit the use-after-free condition to execute arbitrary code with kernel privileges. The issue is particularly relevant in environments heavily utilizing SMC for high-performance inter-process communication over shared memory, where efficient and safe handling of large data buffers is critical.
To mitigate this vulnerability, it is essential that developers ensure page and socket references are acquired before invoking splice_to_pipe() to guarantee proper lifetime coverage for all candidate entries. The smc_rx_spd_release function must be updated to correctly drop private state, page references, and socket references only for those entries that never successfully get queued into the pipe buffer. This adjustment aligns the reference counting logic with the actual lifecycle of the splice entries, preventing underflows and ensuring memory safety. System administrators should apply kernel updates provided by their distribution vendors as soon as patches are available to address this refcount imbalance in the SMC subsystem.
This vulnerability is classified under CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization, specifically regarding reference counting errors that lead to use-after-free conditions. It also relates to CWE-416: Use After Free, as the premature release of resources allows for access to freed memory. In terms of attack vectors and techniques, this flaw could be leveraged in conjunction with ATT&CK technique T1059: Command and Scripting Interpreter if exploited for privilege escalation, or more broadly under T1499: Endpoint Denial of Service due to the potential for kernel instability. Proper synchronization of resource acquisition relative to buffer manipulation is critical to preventing such issues in network stack implementations.