CVE-2026-74631

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

smc_rx_splice is only reached via splice()/tee() on an SMC socket FD (syscall -> smc_splice_read -> smc_rx_recvmsg with pipe set); remote SMC peers can supply receive-buffer data but cannot execute the vulnerable splice path without a local process invoking splice on that socket.

AC:LAttack complexity, low

The attacker controls splice length, can nearly fill the destination pipe to force splice_to_pipe to drop unqueued entries via smc_rx_spd_release, and can hit the multi-page VM-backed RMB path (smcr_buf_type or mixed-buffer vmalloc fallback); no timing race or external victim state is required.

PR:NPrivileges required, none

Exploitation requires only completing an SMC session as a network peer to a victim that reads with splice (common zero-copy SMC pattern); no local account, capabilities, or namespace-admin rights on the victim host are needed beyond normal remote connectivity to the SMC service.

UI:NUser interaction, none

No per-exploit victim action is needed beyond an application already using splice on SMC receive; a malicious peer can deliver the receive data while the victim's normal automated splice path triggers the refcount imbalance without prompts or manual steps.

S:UScope, unchanged

Impact is kernel page refcount underflow and use-after-free within the same kernel security boundary, enabling privilege escalation or crash on the host; it does not cross VM, IOMMU, or sandbox authority boundaries.

C:HConfidentiality impact, high

Refcount imbalance lets smc_rx_spd_release and pipe-buffer teardown free pages while still referenced, creating a UAF on RMB pages that can be turned into arbitrary kernel memory disclosure via heap reuse and spraying.

I:HIntegrity impact, high

Corrupted page lifetime and dangling pipe_buffer state enable heap metadata corruption and arbitrary kernel writes from the UAF primitive, supporting control-flow hijacking and local privilege escalation.

A:HAvailability impact, high

Page refcount underflow and UAF during splice teardown can cause immediate kernel oops/panic; repeated splice from an SMC peer reliably triggers denial-of-service even when full exploitation is not attempted.