Skip to main content

Linux Kernel CVE-2026-52930

| EUVDEUVD-2026-38700 MEDIUM
2026-06-24 Linux GHSA-5g46-hmw3-w78x
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Race condition requires winning a narrow kernel timing window, justifying AC:H over the vendor's AC:L; all other metrics align with the description.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 08, 2026 - 16:13 vuln.today
CVSS changed
Jul 08, 2026 - 15:37 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 09:16 EUVD
CVE Published
Jun 24, 2026 - 07:14 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 07:14 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ipc/shm: serialize orphan cleanup with shm_nattch updates

shm_destroy_orphaned() walks the shm idr under shm_ids(ns).rwsem, but that does not serialize all fields tested by shm_may_destroy(). In particular, shm_nattch is updated while holding shm_perm.lock, and attach paths can do that without holding the rwsem.

Do not decide that an orphaned segment is unused before taking the object lock. Move the shm_may_destroy() check under shm_perm.lock, matching the other destroy paths, and unlock the segment when it no longer qualifies for removal.

AnalysisAI

Race condition in the Linux kernel's System V IPC shared memory subsystem allows a local low-privileged attacker to crash the kernel. The shm_destroy_orphaned() cleanup path evaluates whether an orphaned segment is safe to destroy by checking shm_nattch without holding shm_perm.lock, while the attach/detach paths update that counter independently of shm_ids(ns).rwsem, creating a window where a still-attached segment is erroneously destroyed. The EPSS score is 0.17% (6th percentile) and no KEV listing or public exploit exists, placing this firmly in the routine-patching tier rather than emergency response.

Technical ContextAI

The vulnerable code resides in ipc/shm.c within the Linux kernel's System V IPC subsystem. shm_destroy_orphaned() iterates over shared memory segments using the IPC identifier radix tree (shm idr) while holding shm_ids(ns).rwsem in read mode. It calls shm_may_destroy() to determine whether a segment is safe to free, which includes evaluating shm_nattch (the count of active process attachments). The locking discipline is inconsistent: shm_nattch is updated inside shm_perm.lock by the mmap/munmap attach and detach paths, which do not require the outer rwsem. This is a classic TOCTOU (time-of-check/time-of-use) race: between the moment shm_may_destroy() observes shm_nattch == 0 and the moment the segment is destroyed, another thread may increment the counter via a concurrent attachment. The fix canonically resolves this by moving the shm_may_destroy() check inside shm_perm.lock, consistent with the locking discipline used by all other destroy paths. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. No CWE is assigned in the input; the class is concurrent execution using shared resource with improper synchronization (CWE-362).

RemediationAI

The primary fix is upgrading to a patched Linux kernel stable release: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1, depending on the branch in use. Fix commits for each branch are available at https://git.kernel.org/stable/c/b1e9aef48e4d8a0c1b54fb913077b0824ed7d650 and sibling commits (92cda2593cf2, 1f0d01e35dbb, 6560be3f6a5b, b5107b4ce3ad, db752ebfdaf2, 030bbc857bd5, 2e5c6f4fd400). Distribution-specific updates from RHEL, Ubuntu, Debian, SUSE, and others should be tracked independently. No practical runtime workaround exists: the only way to eliminate the race is to apply the kernel patch. Disabling System V IPC at build time (CONFIG_SYSVIPC=n) would prevent the vulnerability but breaks any application relying on shmget/shmat semantics, including PostgreSQL shared buffers and many legacy enterprise applications - this is not a viable compensating control for most deployments. Prioritize patching in multi-tenant or containerized environments where local DoS has amplified impact.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-52930 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy