CVE-2026-31730 misc: fastrpc: possible double-free of cctx->remote_heap
A double-free vulnerability in the Linux kernel fastrpc driver allows attackers to potentially execute code or escalate privileges via specific ioctl and device removal sequences.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31730?
CVE-2026-31730 is a high-severity use after free vulnerability in Linux kernel, published on 1 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: possible double-free of cctx->remote_heap
fastrpc_init_create_static_process() may free cctx->remote_heap on the err_map path but does not clear the pointer. Later, fastrpc_rpmsg_remove() frees cctx->remote_heap again if it is non-NULL, which can lead to a double-free if the INIT_CREATE_STATIC ioctl hits the error path and the rpmsg device is subsequently removed/unbound. Clear cctx->remote_heap after freeing it in the error path to prevent the later cleanup from freeing it again.
This issue was found by an in-house analysis workflow that extracts AST-based information and runs static checks, with LLM assistance for triage, and was confirmed by manual code review. No hardware testing was performed.
Weakness: CWE-415
Which versions are affected by CVE-2026-31730?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31730?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-31730 being exploited?
There is no known exploitation of CVE-2026-31730 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-31730, DEBIAN-CVE-2026-31730, GHSA-8r84-g6v2-vrq6, ROOT-OS-UBUNTU-2404-CVE-2026-31730, UBUNTU-CVE-2026-31730.