CVE-2026-31787
xen/privcmd: fix double free via VMA splitting
Description
In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace does a partial munmap() on a privcmd mapping, the kernel splits the VMA via __split_vma(). Since may_split is NULL, the split is allowed. vm_area_dup() copies vm_private_data (a pages array allocated in alloc_empty_pages()) into the new VMA without any fixup, because there is no .open callback. Both VMAs now point to the same pages array. When the unmapped portion is closed, privcmd_close() calls: - xen_unmap_domain_gfn_range() - xen_free_unpopulated_pages() - kvfree(pages) The surviving VMA still holds the dangling pointer. When it is later destroyed, the same sequence runs again, which leads to a double free. Fix this issue by adding a .may_split callback denying the VMA split. This is XSA-487 / CVE-2026-31787
INFO
Published Date :
April 30, 2026, 11:16 a.m.
Last Modified :
April 30, 2026, 5:11 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Add a .may_split callback to deny VMA splits.
- Ensure VMA duplication handles private data correctly.
- Apply the provided kernel patch.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-31787.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-31787 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-31787
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-31787 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-31787 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 30, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace does a partial munmap() on a privcmd mapping, the kernel splits the VMA via __split_vma(). Since may_split is NULL, the split is allowed. vm_area_dup() copies vm_private_data (a pages array allocated in alloc_empty_pages()) into the new VMA without any fixup, because there is no .open callback. Both VMAs now point to the same pages array. When the unmapped portion is closed, privcmd_close() calls: - xen_unmap_domain_gfn_range() - xen_free_unpopulated_pages() - kvfree(pages) The surviving VMA still holds the dangling pointer. When it is later destroyed, the same sequence runs again, which leads to a double free. Fix this issue by adding a .may_split callback denying the VMA split. This is XSA-487 / CVE-2026-31787 Added Reference https://git.kernel.org/stable/c/1576ff3869cbd3620717195f971c85b7d7fd62b5 Added Reference https://git.kernel.org/stable/c/2894a351fe2ea8684919d36df3188b9a35e3926f Added Reference https://git.kernel.org/stable/c/2b985d3a024b9e8c24e21671b34e855569763808 Added Reference https://git.kernel.org/stable/c/402d84ad9e89bd4cbfd07ca8598532b7021daf95 Added Reference https://git.kernel.org/stable/c/446ee446d9ae66f36e95c3c90bbcc4e56b94cde0 Added Reference https://git.kernel.org/stable/c/71bf829800758a6e3889096e4754ef47ba7fc850 Added Reference https://git.kernel.org/stable/c/dbf862ce9f009128ab86b234d91413a3e450beb4 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Apr. 30, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/04/28/14 Added Reference http://xenbits.xen.org/xsa/advisory-487.html