CVE-2026-74631

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the smc rx splice() function where pages are passed to splice to pipe() before the necessary references for the splice entry lifetime are established. In the VM-backed RMB path, splice to pipe() may drop unqueued entries via smc rx spd release(), while queued entries are released through the pipe buffer callback. Additionally, post-splice accounting incorrectly derives the number of queued VM pages from a mutated offset and improperly pairs sock hold() with multiple sock put() calls during multi-page splices. This results in a reference count imbalance that can lead to page refcount underflow and a use-after-free condition, where the system attempts to access memory after it has been released.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.