CVE-2026-31787
Description
A flaw was found in the Linux kernel's xen/privcmd module. A local user could exploit this by performing a partial unmapping of a privcmd memory region. This action causes a Virtual Memory Area (VMA) to split, leading to duplicated internal memory pointers. As a result, the same memory can be freed twice, a condition known as a double free, which can cause system instability or a denial of service.
Statement
The vulnerability in the Linux kernel's xen/privcmd module is rated Moderate. This flaw, a double-free issue, can be triggered by a partial munmap() operation on a privcmd mapping, leading to a system crash or potential privilege escalation. Exploitation requires local access and the system to be running within a Xen virtualized environment, limiting its broader impact on typical Red Hat Enterprise Linux installations not configured for Xen.
Mitigation
To mitigate this issue, prevent the `privcmd` kernel module from loading if Xen virtualization is not actively used on the system. This can be achieved by blacklisting the module.
Create a file named `/etc/modprobe.d/blacklist-privcmd.conf` with the following content:
`blacklist privcmd`
After creating the file, regenerate the initramfs and reboot the system for the changes to take effect.
`dracut -f -v` (for RHEL 7/8/9) or `mkinitrd -f -v` (for older RHEL versions)
`reboot`
This mitigation will prevent the `privcmd` module from being loaded at boot, thereby eliminating the vulnerability. However, systems requiring Xen virtualization will lose `privcmd` functionality.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.3 | 7.8 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | Low | High | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity,Availability,Confidentiality
Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart; Execute Unauthorized Code or Commands
This weakness may result in the corruption of memory, and perhaps instructions, possibly leading to a crash. If the corrupted memory can be effectively controlled, it may be possible to execute arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
