CVE-2026-31787: Linux kernel · xen/privcmd: fix double free via VMA splitting
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in dbf862ce9f009128ab86b234d91413a3e450beb4 : patch Linux kernel soon.
Data as of 6 Nov 2026, 16:33 UTC
Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA
Thin evidence
One scorer or none- CISA SSVC
- Exploitation
- No evidence of active exploitation and no public proof of concept
- Automatable
- Attackers cannot reliably automate steps 1–4 of the kill chain
- Technical impact
- Limited control over the software or limited information exposure
CISA SSVC assessment, 2026-11-06.
- Patch
- Available – fixed in dbf862ce9f009128ab86b234d91413a3e450beb4, 2894a351fe2ea8684919d36df3188b9a35e3926f, 1576ff3869cbd3620717195f971c85b7d7fd62b5 +5
Exploitation evidence
Disclosed: evidence found.
CVE published 30 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix is available and has been applied in the Linux kernel by adding a .may_split callback to deny VMA splitting in the privcmd_vm_ops. Users should update to a fixed kernel version containing the commits identified by the fixedVersions hashes. No additional mitigation is required beyond applying the official fix.
Description
CVE-2026-31787 is a vulnerability in the Linux kernel's xen/privcmd component involving a double free caused by improper handling of VMA splitting. The issue arises because the privcmd_vm_ops structure lacks a .may_split callback, allowing a VMA split that results in two VMAs pointing to the same pages array. When one VMA is closed, it frees the pages array, leaving the other VMA with a dangling pointer that leads to a double free upon its destruction. The vulnerability is fixed by adding a .may_split callback to deny VMA splitting.
References
- git.kernel.org/stable/c/dbf862ce9f009128ab86b234d91413a3e450beb4 (opens in a new tab)
- git.kernel.org/stable/c/2b985d3a024b9e8c24e21671b34e855569763808 (opens in a new tab)
- git.kernel.org/stable/c/1576ff3869cbd3620717195f971c85b7d7fd62b5 (opens in a new tab)
- git.kernel.org/stable/c/402d84ad9e89bd4cbfd07ca8598532b7021daf95 (opens in a new tab)
- git.kernel.org/stable/c/2894a351fe2ea8684919d36df3188b9a35e3926f (opens in a new tab)
- git.kernel.org/stable/c/446ee446d9ae66f36e95c3c90bbcc4e56b94cde0 (opens in a new tab)
- git.kernel.org/stable/c/71bf829800758a6e3889096e4754ef47ba7fc850 (opens in a new tab)
- git.kernel.org/stable/c/24daca4fc07f3ff8cd0e3f629cd982187f48436a (opens in a new tab)
- openwall.com/lists/oss-security/2026/04/28/14 (opens in a new tab)
- xenbits.xen.org/xsa/advisory-487.html (opens in a new tab)