## https://sploitus.com/exploit?id=5AD83E31-A463-5C19-BCD9-A08A17DD1BE5
# XSA-487 / CVE-2026-31787
**Linux kernel double free in Xen privcmd driver**
A double free of kernel memory in the Linux kernel's Xen `privcmd` driver
allows circumvention of kernel lockdown (secure boot). Exploitation requires
root-level access, which limits the broader security implications.
| | |
|---|---|
| **Advisory** | [XSA-487](https://xenbits.xen.org/xsa/advisory-487.html) |
| **CVE** | [CVE-2026-31787](https://nvd.nist.gov/vuln/detail/CVE-2026-31787) |
| **Component** | Linux kernel — Xen `privcmd` driver |
| **Public release** | 2026-04-28 |
| **Discovered by** | Atharva Vartak ([@0xAth4rv](https://github.com/0xAth4rv)) |
> This repository contains the advisory only — it is a public record of the
> issue. It does not contain, and will not contain, exploit code.
## Issue description
The Linux kernel's `privcmd` driver contains a vulnerability allowing
circumvention of kernel lockdown (secure boot) through a double free of kernel
memory. Because triggering the flaw requires root-level access, the practical
security impact is limited.
## Impact
An administrator of a domain booted in secure mode is able to perform actions
on the kernel which should not be possible in secure mode.
## Vulnerable systems
- Linux **PVH** or **HVM** domains (x86 or Arm) running **kernel 3.8 or later**.
- Linux **PV** domains are **not** affected.
- Non-Linux domains are **not** affected.
## Mitigation
There is no mitigation available; the fix must be applied via the patch below.
## Resolution
Applying the appropriate patch resolves this issue.
| File | SHA256 |
|------|--------|
| `xsa487-linux.patch` | `fc7ccf9697203c14ced4364d70175b463b08a17a7559fd8654a12b623b54e5bb` |
## Credits
This issue was discovered by **Atharva Vartak** ([@0xAth4rv](https://github.com/0xAth4rv)).
## References
- Xen Security Advisory: https://xenbits.xen.org/xsa/advisory-487.html
- CVE record: https://nvd.nist.gov/vuln/detail/CVE-2026-31787