Skip to main content

Linux Kernel CVE-2026-52993

| EUVDEUVD-2026-38861 CRITICAL
Release of Invalid Pointer or Reference (CWE-763)
2026-06-24 Linux GHSA-m86q-cgj9-94c8
Linux Information Disclosure
9.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.5 MEDIUM

Network-reachable but requires non-default TIPC plus heap grooming to exploit (AC:H); impact is primarily a kernel crash (A:H) with limited integrity and no confidentiality loss.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:44 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
9.8 (CRITICAL)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 cve.org
CRITICAL 9.8
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix double-free in tipc_buf_append()

tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a pointer to a local variable which was a copy of the caller's skb pointer.

If the skb was reallocated and validation subsequently failed, the error handling path would free the original skb pointer, which had already been freed, leading to double-free.

Fix this by checking if head now points to a newly allocated reassembled skb. If it does, reassign *headbuf for later freeing operations.

AnalysisAI

Memory corruption in the Linux kernel's TIPC (Transparent Inter-Process Communication) protocol stack allows remote attackers to trigger a double-free in tipc_buf_append() during message reassembly, where tipc_msg_validate() may reallocate and free the working skb while the error path frees a now-stale pointer. Affected systems are those running a vulnerable kernel (introduced around 4.15-era code, present across 5.10-7.0 branches) with the TIPC subsystem in use; successful exploitation can crash the kernel and, depending on heap conditions, potentially lead to privilege escalation. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%, 7th percentile), and it is not listed in CISA KEV.

Technical ContextAI

TIPC is a Linux kernel networking protocol designed for fast inter-node communication in clustered/cluster-aware environments, exposed via the AF_TIPC socket family and a loadable tipc kernel module. The root cause is a double-free (CWE-415, despite CWE being marked N/A and the tag mislabeling it as 'Information Disclosure') in the fragment reassembly path: tipc_buf_append() passes a pointer to a local copy of the caller's skb into tipc_msg_validate(), which can reallocate (and free) the original skb. If validation then fails, the error handler frees the original pointer that was already released, corrupting kernel heap state. The fix detects when head points to a freshly allocated reassembled skb and reassigns *headbuf so the later free operates on the correct buffer. Affected products per CPE are limited to cpe:2.3:a:linux:linux, i.e. the upstream Linux kernel.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 (or later in each series), applying the build your distribution ships that incorporates the corresponding git.kernel.org/stable commit. The most effective compensating control where patching is delayed is to disable the TIPC attack surface entirely: prevent the module from loading by blacklisting it (e.g. add 'install tipc /bin/true' in modprobe.d) if TIPC is not required - the trade-off is that any application relying on AF_TIPC will break, but most general-purpose servers do not use TIPC. If TIPC is in use, restrict it to trusted network segments and filter TIPC traffic (EtherType 0x88ca for L2-bearer TIPC, or the configured UDP bearer port) at the network boundary so untrusted hosts cannot send reassemblable fragments. Track fixes via the kernel.org stable commits and NVD entry above.

Same weakness CWE-763 – Release of Invalid Pointer or Reference

View all
CVE-2024-44852 CRITICAL POC
9.8
CVE-2020-11105 CRITICAL POC
9.8
CVE-2018-6836 CRITICAL POC
9.8
CVE-2024-6607 HIGH POC
8.8
CVE-2023-34312 HIGH POC
7.8
CVE-2022-28203 HIGH POC
7.5
CVE-2022-37451 HIGH POC
7.5
CVE-2021-21401 HIGH POC
7.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.177 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.155 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.206 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.152 Affected
Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:5.4.4.5.149 Affected
Container suse/sle-micro/base-5.5:2.0.4-5.8.296 Affected
Container suse/sle-micro/kvm-5.5:2.0.4-3.5.570 Affected

Share

CVE-2026-52993 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy