Linux kernel net/smc double-free of smc_spd_priv via tee()-duplicated splice pipe buffer

CVE-2026-31507 is a Linux kernel vulnerability in the SMC networking subsystem (net/smc). The flaw occurs in the splice receive path: smc_rx_splice() allocates one smc_spd_priv object per pipe_buffer and stores the pointer in pipe_buffer.private. The affected pipe_buf_operations used .get = generic_pipe_buf_get, which increments only the backing page reference count when tee(2) duplicates a pipe buffer, but does not duplicate or refcount the associated smc_spd_priv object. As a result, after tee() duplicates the buffer, both the original and cloned pipe_buffer instances reference the same smc_spd_priv pointer. When the two pipes are later released, smc_rx_pipe_buf_release() runs twice on the same object. The first release frees the object and updates socket and consumer state; the second release operates on already freed memory, causing a double-free/use-after-free condition. KASAN reported a slab-use-after-free in smc_rx_pipe_buf_release(), and the bug can further escalate to a NULL-pointer dereference in smc_rx_update_consumer() when dereferencing freed state. The issue also has a semantic side effect: duplicated release processing can advance the SMC consumer cursor twice for the same data, corrupting receive-window accounting.