What is the CVSS score of CVE-2026-52943?

CVE-2026-52943 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-52943?

24 hours: Inventory all Linux systems and assess exposure; prioritize those with local user access or shared tenants. 7 days: Apply available Linux kernel patch to critical production systems. 30 days: Complete patching of all Linux infrastructure and verify deployment compliance.

Linux Kernel CVE-2026-52943

EUVD-2026-38732 HIGH

Improper Update of Reference Count (CWE-911)

2026-06-24 Linux

GHSA-vwrr-994w-h832

Privilege Escalation Linux

7.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Obtain unprivileged local shell
Delivery

Open zerocopy TX socket (MSG_ZEROCOPY)
Exploit

Trigger pskb_carve copying shinfo without refcount
Install

Drive uarg refcnt to zero, free ubuf_info
C2

Reuse freed object via skb_release_data UAF
Execute

Corrupt kernel memory for write primitive
Impact

Escalate to root

Vulnerability Assessment

Weakness	CWE CWE-911
Exploitation Conditions	Requires local code execution as an unprivileged user on the target (AV:L, PR:L) with no user interaction. The host must run an affected kernel built with MSG_ZEROCOPY-capable networking (standard in default configurations) and the attacker must be able to open sockets and exercise the zerocopy TX path plus the skb carve helpers; the observed crash path involves the RDS protocol (rds_tcp) receive path, so reachability of RDS sockets aids the demonstrated PoC. The vendor states exploitation is reliable on a default kernel configuration, so no exotic non-default tuning is needed. Limiting factors: it is local-only (not remotely exploitable over the network), needs the ability to run arbitrary local code, and is fixed in the patched stable releases listed; environments that block unprivileged socket creation or remove RDS reduce the demonstrated attack surface.
Impact	All signals point to a genuine, high-priority local kernel bug rather than a paper-high CVSS. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High) reflects local access, low complexity, low privileges, no user interaction, and full confidentiality/integrity/availability impact - consistent with the description of an unprivileged local user achieving root. The strongest signal is the vendor-confirmed, reliably exploitable proof-of-concept yielding full privilege escalation on a default config; this elevates real risk well above the modest EPSS score of 0.21% (11th percentile). EPSS measures probability of broad internet-facing exploitation, which is naturally low for a local-only kernel UAF, so the low EPSS does NOT contradict the high practical danger - it simply reflects that this is a local, not remote-network, attack. Not present in CISA KEV, so there is no confirmation of in-the-wild exploitation; treat as 'publicly available exploit code/technique exists' rather than 'actively exploited.' No data conflict in the CVSS vector itself: AV:L matches the description's 'local user' framing.
Exploit ScenarioDerived	An unprivileged local user logs into a shell on a multi-tenant Linux host and runs a proof-of-concept that crafts socket operations exercising the MSG_ZEROCOPY transmit path together with skb carving (e.g. via TCP send plus error-queue recv and RDS receive), driving a ubuf_info refcount to zero while skbs still reference it. The resulting use-after-free in skb_release_data is groomed into a kernel write primitive, yielding full root. A reliable working PoC for this exact escalation has been confirmed by the reporter on a default kernel configuration.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Local privilege escalation in the Linux kernel networking stack (skbuff/MSG_ZEROCOPY path) allows an unprivileged local user to gain full root via a use-after-free on ubuf_info_msgzc. The pskb_carve_inside_header() and pskb_carve_inside_nonlinear() helpers memcpy the skb_shared_info (including the zerocopy destructor_arg/uarg pointer) into a new buffer without calling net_zcopy_get(), so the uarg refcount is decremented more times than it was incremented, freeing the ubuf_info while live TX skbs still reference it. A working proof-of-concept exists that achieves reliable root escalation on a default kernel configuration; the issue is not listed in CISA KEV and EPSS probability is low (0.21%, 11th percentile).

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, or 7.0.12 (and 7.1+ mainline), matching the branch you run, then reboot to load the patched kernel. The fix adds the missing net_zcopy_get() to pskb_carve_inside_header() (after skb_orphan_frags succeeds) and pskb_carve_inside_nonlinear() (just before skb_release_data), mirroring pskb_expand_head; apply it via your distribution's kernel update channel or the kernel.org stable commits (e.g. https://git.kernel.org/stable/c/474d6c771d798bca84f0a140b611e36743511e18). If immediate patching is impossible, compensating controls are limited because the trigger is core networking code: restrict the ability of untrusted users to run local code (the attack requires local access), and where feasible disable or restrict MSG_ZEROCOPY usage paths and RDS - for example blacklist the rds and rds_tcp modules (modprobe blacklist) if RDS is not needed, accepting loss of RDS functionality; note these reduce but do not fully eliminate exposure since the bug is in generic skb carve helpers, so patching is the only complete fix.

Affected VersionsENISA

Linux 6fa01ccd883021105e9f8af7d04b9f156fa3494a <2e0e74c59b2761a414d9f48d7bee1e45220b2427

Linux 6fa01ccd883021105e9f8af7d04b9f156fa3494a <474d6c771d798bca84f0a140b611e36743511e18

Linux patch: 6.12.93

Linux 6fa01ccd883021105e9f8af7d04b9f156fa3494a <98d0912e9f841e5529a5b89a972805f34cb1c69d

Linux 6fa01ccd883021105e9f8af7d04b9f156fa3494a <96a4713ae041cc85e712bac682cd2e644004d6c6

Linux patch: 7.1

Linux 6fa01ccd883021105e9f8af7d04b9f156fa3494a <9b40bdc2a3298225dffab8158208a0d8c6300578

Linux patch: 0

Linux 6fa01ccd883021105e9f8af7d04b9f156fa3494a <8dbed691e43a50903658130bde0fcb5abc425b37

Linux patch: 7.0.12

Linux patch: 6.1.176

Linux patch: 5.15.210

Linux patch: 6.18.35

Linux patch: 6.6.143

Linux 6fa01ccd883021105e9f8af7d04b9f156fa3494a <ceafb893b12f23331dcc5ff9587e643c3a40ee9f

Linux 6fa01ccd883021105e9f8af7d04b9f156fa3494a <fd470f0a97b8e9a125f520265d2f3b088ffb5b8a

Linux 4.7

Linux patch: 5.10.259

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw lives in the kernel socket buffer (sk_buff) management code in net/core/skbuff.c, specifically the pskb_carve* helpers that reorganize an skb's headers and fragments. Each skb carries a skb_shared_info structure whose destructor_arg field points to a ubuf_info_msgzc reference-counted object used by the MSG_ZEROCOPY transmit path (msg_zerocopy_realloc allocates it during tcp_sendmsg_locked). When pskb_carve_inside_header()/pskb_carve_inside_nonlinear() clone the shinfo via memcpy(), the copied destructor_arg is a new holder of the uarg, but unlike the analogous pskb_expand_head() they never call net_zcopy_get() to bump uarg->refcnt. On free, skb_zcopy_clear() runs for each shinfo copy, driving the refcount to zero prematurely. This is a classic CWE-416 use-after-free (the input lists CWE as N/A); the dangling read is observed in skb_release_data() during queue purge (e.g. rds_tcp_inc_free via rds_recvmsg, and the alloc/free interleaving with ip_recv_error/tcp_recvmsg error queue handling).

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.8 HIGH

Local unprivileged user (AV:L, PR:L) reliably triggers a kernel UAF with no interaction, yielding root and thus full C/I/A impact; scope unchanged as it is same-kernel privilege gain.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE 7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat 7.8 HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jun 28, 2026 - 08:22 NVD

7.8 (HIGH)

Patch available

Jun 24, 2026 - 11:01 EUVD

CVE Published

Jun 24, 2026 - 09:00 cve.org

HIGH 7.8

CVE Published

Jun 24, 2026 - 09:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: fix missing zerocopy reference in pskb_carve helpers

pskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy the old skb_shared_info header into a new buffer via memcpy(), which includes the destructor_arg pointer (uarg) for MSG_ZEROCOPY skbs. Neither function calls net_zcopy_get() for the new shinfo, creating an unaccounted holder: every skb_shared_info with destructor_arg set will call skb_zcopy_clear() once when freed, but the corresponding net_zcopy_get() was never called for the new copy. Repeated calls drive uarg->refcnt to zero prematurely, freeing ubuf_info_msgzc while TX skbs still hold live destructor_arg pointers.

KASAN reports use-after-free on a freed ubuf_info_msgzc:

BUG: KASAN: slab-use-after-free in skb_release_data+0x77b/0x810 Read of size 8 at addr ffff88801574d3e8 by task poc/220

Call Trace: skb_release_data+0x77b/0x810 kfree_skb_list_reason+0x13e/0x610 skb_release_data+0x4cd/0x810 sk_skb_reason_drop+0xf3/0x340 skb_queue_purge_reason+0x282/0x440 rds_tcp_inc_free+0x1e/0x30 rds_recvmsg+0x354/0x1780 __sys_recvmsg+0xdf/0x180

Allocated by task 219: msg_zerocopy_realloc+0x157/0x7b0 tcp_sendmsg_locked+0x2892/0x3ba0

Freed by task 219: ip_recv_error+0x74a/0xb10 tcp_recvmsg+0x475/0x530

The skb consuming the late access still referenced the same uarg via shinfo->destructor_arg copied by pskb_carve_inside_nonlinear() without a refcount bump. This has been verified to be reliably exploitable: a working proof-of-concept achieves full root privilege escalation from an unprivileged local user on a default kernel configuration.

The fix follows the pattern of pskb_expand_head() which has the same memcpy/cloned structure. For pskb_carve_inside_header(), net_zcopy_get() is placed after skb_orphan_frags() succeeds, so the orphan error path needs no cleanup. For pskb_carve_inside_nonlinear(), net_zcopy_get() is placed after all failure points and just before skb_release_data(), so no error path needs cleanup at all -- matching pskb_expand_head() more closely and avoiding the need for a balancing net_zcopy_put().

Executive ViewAI

Why It Matters

CVE-2026-52943 is a local privilege escalation vulnerability in the Linux kernel networking stack for which publicly available exploit code exists. It allows unprivileged local users to achieve root access through a use-after-free defect in packet socket handling. Organizations operating multi-user Linux systems or cloud infrastructure are at risk if they have untrusted local access scenarios.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 89% exploitable

Prevalence

Ubiquitous

Linux kernel networking core, present in nearly all Linux deployments

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Same weakness CWE-911 – Improper Update of Reference Count

View all

CVE-2022-29581 HIGH POC

7.8

CVE-2026-46316 CRITICAL

9.3

8.8

8.1

7.8

7.8

7.5

7.5

Same technique Privilege Escalation

View all

CVE-2024-0012 CRITICAL POC

9.3

CVE-2025-47812 CRITICAL POC

10.0

CVE-2013-0422 CRITICAL POC

9.8

CVE-2013-0632 CRITICAL POC

9.8

CVE-2024-9474 MEDIUM POC

6.9

CVE-2017-5689 CRITICAL POC

9.8

CVE-2021-20021 CRITICAL POC

9.8

CVE-2017-12635 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.168 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.149	Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.197 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.145	Affected
Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:5.4.4.5.149	Affected
Container suse/sle-micro/base-5.5:2.0.4-5.8.296	Affected
Container suse/sle-micro/kvm-5.5:2.0.4-3.5.570	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

Container suse/sle-micro/rt-5.5:2.0.4-4.5.642	Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure	Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE	Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE	Affected
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP4	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise Live Patching 15 SP4	Fixed
SUSE Linux Enterprise Live Patching 15 SP5	Fixed
SUSE Linux Enterprise Live Patching 15 SP6	Fixed
SUSE Linux Enterprise Live Patching 15 SP7	Fixed
SUSE Linux Enterprise Micro 5.3	Fixed
SUSE Linux Enterprise Micro 5.4	Fixed
SUSE Linux Enterprise Micro 5.5	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7	Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7	Fixed
SUSE Linux Enterprise Module for Legacy 15 SP7	Fixed
SUSE Linux Enterprise Module for Public Cloud 15 SP7	Fixed
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7	Fixed
SUSE Linux Enterprise Server 15 SP4-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP5-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP4	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP5	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed
SUSE Linux Enterprise Workstation Extension 15 SP7	Fixed
SUSE Linux Micro 6.0	Fixed
SUSE Linux Micro 6.1	Fixed
SUSE Linux Micro 6.2	Fixed
SUSE Manager Proxy LTS 4.3	Fixed
SUSE Manager Retail Branch Server LTS 4.3	Fixed
SUSE Manager Server LTS 4.3	Fixed
openSUSE Leap 16.0	Fixed
SUSE Linux Enterprise Live Patching 15 SP7	Affected