HIGH
xen PrivCmd Double-Free
CVE-2026-31787
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace does a partial munmap() on a privcmd mapping, the kernel splits the VMA via __split_vma(). Since may_split is NULL, the split is allowed. vm_area_dup() copies vm_private_data (a pages array allocated in alloc_empty_pages()) into the new VMA without any fixup, because there is no .open callback. Both VMAs now point to the same pages array. When the unmapped portion is closed, privcmd_close() calls: - xen_unmap_domain_gfn_range() - xen_free_unpopulated_pages() - kvfree(pages) The surviving VMA still holds the dangling pointer. When it is later destroyed, the same sequence runs again, which leads to a double free. Fix this issue by adding a .may_split callback denying the VMA split. This is XSA-487 / CVE-2026-31787
02KernelScan AI Analysis
Risk summary
Local users with access to Xen privcmd can trigger a double free vulnerability through partial munmap operations on privcmd mappings. This can lead to kernel memory corruption, privilege escalation, or system crashes in Xen-based virtualization environments.
Vulnerability analysis
The vulnerability occurs because privcmd_vm_ops defines a .close callback but lacks .may_split and .open callbacks. When userspace performs a partial munmap() on a privcmd mapping, the kernel splits the VMA via __split_vma(). Since may_split is NULL, the split proceeds, and vm_area_dup() copies the vm_private_data (pages array) to the new VMA without proper handling. Both VMAs then point to the same pages array. When the unmapped portion is closed, privcmd_close() frees the pages array with kvfree(). Later, when the surviving VMA is destroyed, the same cleanup sequence runs again, causing a double free. The fix adds a .may_split callback that returns -EINVAL to prevent VMA splitting entirely. This vulnerability requires local access to the Xen privcmd interface, typically available to privileged processes in Xen dom0 or processes with appropriate permissions.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 5.10 | 5.10.254 | dbf862ce9f00 |
| 5.15 | 5.15.204 | 2b985d3a024b |
| 6.1 | 6.1.170 | 1576ff3869cb |
| 6.12 | 6.12.85 | 2894a351fe2e |
| 6.18 | 6.18.26 | 446ee446d9ae |
| 6.6 | 6.6.137 | 402d84ad9e89 |
| 7.0 | 7.0.3 | 71bf82980075 |
| mainline | 7.1-rc2 | 24daca4fc07f |