0xatharv/cve-2026-31787Linux kernel double free in Xen privcmd driver
Linux kernel double free in Xen privcmd driver
A double free of kernel memory in the Linux kernel's Xen privcmd driver
allows circumvention of kernel lockdown (secure boot). Exploitation requires
root-level access, which limits the broader security implications.
| Advisory | XSA-487 |
| CVE | CVE-2026-31787 |
| Component | Linux kernel — Xen privcmd driver |
| Public release | 2026-04-28 |
| Discovered by | Atharva Vartak (@0xAth4rv) |
This repository contains the advisory only — it is a public record of the issue. It does not contain, and will not contain, exploit code.
The Linux kernel's privcmd driver contains a vulnerability allowing
circumvention of kernel lockdown (secure boot) through a double free of kernel
memory. Because triggering the flaw requires root-level access, the practical
security impact is limited.
An administrator of a domain booted in secure mode is able to perform actions on the kernel which should not be possible in secure mode.
There is no mitigation available; the fix must be applied via the patch below.
Applying the appropriate patch resolves this issue.
| File | SHA256 |
|---|---|
xsa487-linux.patch | fc7ccf9697203c14ced4364d70175b463b08a17a7559fd8654a12b623b54e5bb |
This issue was discovered by Atharva Vartak (@0xAth4rv).
