Answer in brief
CVE-2026-74631 records a High severity (CVSS 8.4) vulnerability in net: smc: fix splice entry lifetime imbalance in smc_rx_splice. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=9014db202cb764b8e14c53e7bacc81f9a1a2ba7f <c841789e456ec6751342fa800639ce8e82ff0e6b || >=9014db202cb764b8e14c53e7bacc81f9a1a2ba7f <af02c67ce654356c58db20a0bb2db33ace3b07a8 || >=9014db202cb764b8e14c53e7bacc81f9a1a2ba7f <ca8342b5fc24c249fdb998468f6a168b457c67e5 || >=9014db202cb764b8e14c53e7bacc81f9a1a2ba7f <0b7d54cedea5cb158e21925ae0c6c2f5c87ed2a0 || >=9014db202cb764b8e14c53e7bacc81f9a1a2ba7f <4515c78f4d9fd577270f012efeb062ea58b3682d || >=9014db202cb764b8e14c53e7bacc81f9a1a2ba7f <5d9686af2976741bbd79b150d1c9e60b81e7f12e | c841789e456ec6751342fa800639ce8e82ff0e6b, af02c67ce654356c58db20a0bb2db33ace3b07a8, ca8342b5fc24c249fdb998468f6a168b457c67e5, 0b7d54cedea5cb158e21925ae0c6c2f5c87ed2a0, 4515c78f4d9fd577270f012efeb062ea58b3682d, 5d9686af2976741bbd79b150d1c9e60b81e7f12e |
| Linux/Linuxgeneric | 4.18 | Not reported |
| Linux/Linuxgeneric | >=9014db202cb764b8e14c53e7bacc81f9a1a2ba7f <7ddc7af2ae7fc5a0c0635b245c0824c8b76de5cb || >=9014db202cb764b8e14c53e7bacc81f9a1a2ba7f <07ad246529d136d5ef441d5ab4c305d132ff3090 || >=9014db202cb764b8e14c53e7bacc81f9a1a2ba7f <c841789e456ec6751342fa800639ce8e82ff0e6b || >=9014db202cb764b8e14c53e7bacc81f9a1a2ba7f <af02c67ce654356c58db20a0bb2db33ace3b07a8 || >=9014db202cb764b8e14c53e7bacc81f9a1a2ba7f <ca8342b5fc24c249fdb998468f6a168b457c67e5 || >=9014db202cb764b8e14c53e7bacc81f9a1a2ba7f <0b7d54cedea5cb158e21925ae0c6c2f5c87ed2a0 || >=9014db202cb764b8e14c53e7bacc81f9a1a2ba7f <4515c78f4d9fd577270f012efeb062ea58b3682d || >=9014db202cb764b8e14c53e7bacc81f9a1a2ba7f <5d9686af2976741bbd79b150d1c9e60b81e7f12e | 7ddc7af2ae7fc5a0c0635b245c0824c8b76de5cb, 07ad246529d136d5ef441d5ab4c305d132ff3090, c841789e456ec6751342fa800639ce8e82ff0e6b, af02c67ce654356c58db20a0bb2db33ace3b07a8, ca8342b5fc24c249fdb998468f6a168b457c67e5, 0b7d54cedea5cb158e21925ae0c6c2f5c87ed2a0, 4515c78f4d9fd577270f012efeb062ea58b3682d, 5d9686af2976741bbd79b150d1c9e60b81e7f12e |
Published upstream
Aug 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 22, 2026
In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smc_rx_splice smc_rx_splice() passes pages to splice_to_pipe() before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splice_to_pipe() may drop unqueued entries through smc_rx_spd_release(), while queued entries are released later via the pipe buffer callback. The old post-splice accounting also derives the number of queued VM pages from an offset mutated while building the descriptor, and a multi-page splice pairs one sock_hold() with multiple sock_put() calls. Take the page and socket references for every candidate entry before splice_to_pipe(), and drop the matching private state, page reference, and socket reference from smc_rx_spd_release() for entries that never get queued. This fixes a refcount imbalance that can underflow page refcounts and trigger a use-after-free.
Quoted source text, attributed separately from HOL analysis.