In the Linux kernel, the following vulnerability has been resolved:
xen/privcmd: fix double free via VMA splitting
privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace does a partial munmap() on a privcmd mapping, the kernel splits the VMA via __split_vma(). Since may_split is NULL, the split is allowed. vm_area_dup() copies vm_private_data (a pages array allocated in alloc_empty_pages()) into the new VMA without any fixup, because there is no .open callback.
Both VMAs now point to the same pages array. When the unmapped portion is closed, privcmd_close() calls: - xen_unmap_domain_gfn_range() - xen_free_unpopulated_pages() - kvfree(pages)
The surviving VMA still holds the dangling pointer. When it is later destroyed, the same sequence runs again, which leads to a double free.
Fix this issue by adding a .may_split callback denying the VMA split.
This is XSA-487 / CVE-2026-31787
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libperfUpgrade kernel-rt-64kUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-64k-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-modules-extraUpgrade kernel-rt-64k-debug-develUpgrade kernel-64k-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade kernel-cross-headersUpgrade kernel-devel-matchedUpgrade kernel-64kUpgrade kernel-64k-debug-coreUpgrade kernel-64k-debugUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-64k-debug-coreUpgrade kernel-abi-stablelistsUpgrade perfUpgrade kernel-toolsUpgrade rvUpgrade kernel-tools-libs-develUpgrade kernelUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-coreUpgrade kernel-rtUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-modulesUpgrade kernel-rt-64k-modulesUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-64k-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debugUpgrade kernel-docUpgrade kernel-rt-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-debug-modulesUpgrade kernel-modules-extraUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-64k-debug-develUpgrade kernel-64k-modules-coreUpgrade kernel-debug-uki-virtUpgrade kernel-uki-virtUpgrade kernel-64k-develUpgrade kernel-headersUpgrade kernel-64k-modules-extraUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-develUpgrade kernel-develUpgrade kernel-zfcpdumpUpgrade kernel-rt-64k-debugUpgrade kernel-debug-develUpgrade python3-perfUpgrade kernel-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-debug-coreUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-rt-64k-develUpgrade kernel-rt-debugUpgrade kernel-rt-64k-coreUpgrade bpftoolUpgrade kernel-rt-develUpgrade kernel-tools-libsUpgrade rtlaUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-modulesUpgrade kernel-rt-debug-modules-core | Jun 17, 2026 | Jun 16, 2026 |
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-develUpgrade python-perfUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade kernel-develUpgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade kernel-headersUpgrade kernel-livepatch-5.10.255-253.1008Upgrade bpftoolUpgrade kernelUpgrade kernel-livepatch-5.15.204-143.230Upgrade kernel-debuginfoUpgrade python-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade python3-perf6.18-debuginfoUpgrade kernel6.18Upgrade kernel6.18-tools-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade kernel6.18-develUpgrade kernel6.18-modules-extraUpgrade perf6.18Upgrade kernel-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel-develUpgrade kernel6.18-debuginfoUpgrade kernel-livepatch-6.1.170-210.320Upgrade kernel-headersUpgrade bpftoolUpgrade kernel6.18-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.18-tools-develUpgrade python3-perfUpgrade python3-perf6.18Upgrade bpftool6.18-debuginfoUpgrade kernel6.18-toolsUpgrade kernelUpgrade python3-perf-debuginfoUpgrade kernel-modules-extraUpgrade kernel-livepatch-6.18.30-61.116Upgrade perf6.18-debuginfoUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade kernel6.18-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade perfUpgrade bpftool6.18Upgrade kernel6.18-modules-extra-common | May 19, 2026 | Apr 30, 2026 |
| Debian | — | Upgrade linux-6.1Upgrade linux | May 3, 2026 | May 3, 2026 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Jun 18, 2026 | Apr 30, 2026 |
| Rocky_linux | — | Upgrade kernel-rt-debuginfoUpgrade kernel-debuginfoUpgrade kernel-modulesUpgrade kernel-devel-matchedUpgrade kernel-rtUpgrade libperfUpgrade kernel-rt-debug-modules-coreUpgrade kernel-coreUpgrade python3-perfUpgrade perf-debuginfoUpgrade rvUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-uki-virt-addonsUpgrade libperf-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-debug-develUpgrade rtlaUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-modules-coreUpgrade perfUpgrade kernel-rt-debug-develUpgrade kernel-rt-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-develUpgrade kernel-develUpgrade kernel-rt-coreUpgrade kernel-toolsUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debugUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-modulesUpgrade python3-perf-debuginfoUpgrade kernel-tools-libsUpgrade kernel-rt-debug-coreUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debugUpgrade kernel-rt-debug-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-modules-coreUpgrade kernel-debug-modules-coreUpgrade kernel-debug-debuginfoUpgrade kernel-rt-develUpgrade kernel-modules-extra-matchedUpgrade kernel-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-debug-coreUpgrade bpftoolUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-modules-extraUpgrade kernelUpgrade kernel-zfcpdump-modules-extra | Jun 22, 2026 | Jun 19, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 12, 2026 | Apr 30, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub