CVE-2026-31787 xen/privcmd: fix double free via VMA splitting
A double free vulnerability in the Linux kernel's Xen privcmd driver allows local attackers to potentially execute code or escalate privileges via VMA splitting.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31787?
CVE-2026-31787 is a high-severity use after free vulnerability in Linux kernel, published on 30 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xen/privcmd: fix double free via VMA splitting
privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace does a partial munmap() on a privcmd mapping, the kernel splits the VMA via __split_vma(). Since may_split is NULL, the split is allowed. vm_area_dup() copies vm_private_data (a pages array allocated in alloc_empty_pages()) into the new VMA without any fixup, because there is no .open callback.
Both VMAs now point to the same pages array. When the unmapped portion is closed, privcmd_close() calls: - xen_unmap_domain_gfn_range() - xen_free_unpopulated_pages() - kvfree(pages)
The surviving VMA still holds the dangling pointer. When it is later destroyed, the same sequence runs again, which leads to a double free.
Fix this issue by adding a .may_split callback denying the VMA split.
This is XSA-487 / CVE-2026-31787
Weakness: CWE-415
Which versions are affected by CVE-2026-31787?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31787?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-31787 being exploited?
There is no known exploitation of CVE-2026-31787 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-31787, DEBIAN-CVE-2026-31787, GHSA-3c28-g28m-gm93, ROOT-OS-DEBIAN-11-CVE-2026-31787, ROOT-OS-UBUNTU-2204-CVE-2026-31787, UBUNTU-CVE-2026-31787.