CVE-2026-31730misc: fastrpc: possible double-free of cctx->remote_heap
- 7.8HighCVSS base score
- 0.13%Exploitation in 30 daysEPSS · top 97% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: possible double-free of cctx->remote_heap fastrpc_init_create_static_process() may free cctx->remote_heap on the err_map path but does not clear the pointer. Later, fastrpc_rpmsg_remove() frees cctx->remote_heap again if it is non-NULL, which can lead to a double-free if the INIT_CREATE_STATIC ioctl hits the error path and the rpmsg device is subsequently removed/unbound. Clear cctx->remote_heap after freeing it in the error path to prevent the later cleanup from freeing it again. This issue was found by an in-house analysis workflow that extracts AST-based information and runs static checks, with LLM assistance for triage, and was confirmed by manual code review. No hardware testing was performed.
Timeline
ID reserved
By Linux
- 53 days later
· 53 days later
Published
- 3 months later
· 3 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.13% · top 97% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 0871561055e666da421d779397efcc1e5e964cab – < 4b8e527aca357a6488680713bd88007cf8f547fe
- affected 0871561055e666da421d779397efcc1e5e964cab – < 0bdee4118340c5a756220c1b29a7dab86bb0aa65
- affected 0871561055e666da421d779397efcc1e5e964cab – < 3a164f640953cc982804746e772d379171aff5c6
- affected 0871561055e666da421d779397efcc1e5e964cab – < f67d368d26764a357691b2b3a33d3cb55b435bfc
- affected 0871561055e666da421d779397efcc1e5e964cab – < ba2c83167b215da30fa2aae56b140198cf8d8408
- affected 6.2
- unaffected < 6.2
- unaffected 6.6.134 – ≤ 6.6.*
- unaffected 6.12.81 – ≤ 6.12.*
- unaffected 6.18.22 – ≤ 6.18.*
- unaffected 6.19.12 – ≤ 6.19.*
- unaffected 7.0 – ≤ *
References
References5
- https://git.kernel.org/stable/c/4b8e527aca357a6488680713bd88007cf8f547fe (opens in a new tab)
- https://git.kernel.org/stable/c/0bdee4118340c5a756220c1b29a7dab86bb0aa65 (opens in a new tab)
- https://git.kernel.org/stable/c/3a164f640953cc982804746e772d379171aff5c6 (opens in a new tab)
- https://git.kernel.org/stable/c/f67d368d26764a357691b2b3a33d3cb55b435bfc (opens in a new tab)
- https://git.kernel.org/stable/c/ba2c83167b215da30fa2aae56b140198cf8d8408 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-26543 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-31730)Record last updated .