Skip to main content

Linux Kernel EUVDEUVD-2026-38726

| CVE-2026-52923 HIGH
Expired Pointer Dereference (CWE-825)
2026-06-24 Linux GHSA-m237-4jxg-w5jh
Information Disclosure Linux Checkpoint
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local privileged access to CRIU/IPC path
  2. Delivery
    Exhaust valid SysV IPC id tail
  3. Exploit
    Write crafted next_id spilling past ipc_mni
  4. Execution
    Free object leaving dangling IDR slot
  5. Persist
    Read /proc/sysvipc/shm to trigger UAF
  6. Impact
    Leak or corrupt kernel memory

Vulnerability Assessment

Weakness
CWE
CWE-825
ASVS 5.0
V15 - Secure Coding and Architecture Expired pointer prevention
Exploitation Conditions

Exploitation requires local access and the privilege to drive the checkpoint/restore (CRIU) path that writes ids->next_id for SysV IPC - i.e. CONFIG_CHECKPOINT_RESTORE must be enabled and the actor must be able to set the IPC next_id sysctl (typically CAP_CHECKPOINT_RESTORE/CAP_SYS_ADMIN in the relevant namespace). The attacker must also first exhaust the valid SysV IPC id tail so that a further request spills beyond ipc_mni, then trigger a read of /proc/sysvipc/shm to reach the stale entry. Limiting factors: no remote vector (AV:L), no exploitation against default unprivileged users, dependence on the non-default checkpoint/restore feature and the privilege to use it, and the need to fully fill the IPC id space - all of which substantially narrow real-world exploitability despite the 7.8 score.
Impact

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a high-impact local issue: it requires local access and some privilege but no user interaction, and yields high confidentiality, integrity and availability impact consistent with a use-after-free that can corrupt kernel state. Real-world risk signals are mixed and point to lower urgency than the score alone suggests: EPSS is only 0.17% (6th percentile), there is no CISA KEV listing, and no public PoC has been identified. Crucially, exploitation depends on the checkpoint/restore sysctl path (CONFIG_CHECKPOINT_RESTORE and write access to ids->next_id), which is not reachable by an ordinary unprivileged user in default configurations - this is a meaningful limiter not captured by the raw CVSS vector. Note a tag-versus-mechanism tension: the supplied Tags say 'Information Disclosure,' but the described primitive is a UAF dangling pointer that can also corrupt kernel memory (matching the I:H/A:H impact), so impact may exceed pure disclosure - verify against the actual exploitation primitive. Net: a legitimate kernel hardening fix worth patching in normal cycles, but not an emergency for most fleets given the privileged/config-gated trigger and absence of in-the-wild exploitation.
Exploit ScenarioDerived

A local attacker with the ability to invoke the SysV IPC checkpoint/restore path (e.g. inside a privileged container or via CRIU-style restore) fills the valid IPC id tail, then writes a crafted next_id so ipc_idr_alloc() spills an allocation past ipc_mni. The mismatched index encoding leaves a dangling IDR slot after the object is freed; the attacker then reads /proc/sysvipc/shm to trigger a use-after-free, leaking freed kernel memory or corrupting kernel state for potential privilege escalation. No public PoC is currently identified, and the attack requires local access plus the privilege to use the checkpoint/restore feature.
This Week Schedule remediation this week. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Local privilege escalation and information disclosure in the Linux kernel's SysV IPC subsystem stems from an unbounded ID allocation in ipc_idr_alloc() along the checkpoint/restore (CRIU) path, where a user-supplied next_id can spill past the valid ipc_mni range. Because removal truncates the index via ipcid_to_idx(), a high-index object can be freed while its real IDR slot dangles, so a subsequent /proc/sysvipc/shm walk dereferences freed memory - a use-after-free. No public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile) and the issue is not on CISA KEV.

RemediationAI

Apply your distribution's kernel update built from one of the fixed stable releases - Vendor-released patch: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 7.0.12, or 7.1 (choose the patch level matching your series), referencing the stable commits at git.kernel.org/stable/c/8c58a92849175f5e2ab7bc2734b3b89afe79f6ef and related hashes. The fix simply bounds the requested allocation to ipc_mni so the checkpoint/restore path fails cleanly once the valid id range is exhausted. Where immediate patching is not possible, the most effective compensating control is to disable the checkpoint/restore attack surface: build/run a kernel without CONFIG_CHECKPOINT_RESTORE, or restrict who can write ids->next_id and use CRIU/restore functionality - trade-off being loss of container live-migration and checkpoint/restore capability. Additionally restrict the capabilities and namespaces that allow privileged IPC manipulation (avoid granting CAP_SYS_ADMIN/CAP_CHECKPOINT_RESTORE in untrusted containers), accepting reduced container flexibility, and monitor/limit access to /proc/sysvipc. Confirm exact fixed package versions via your distribution advisory before deploying.

Affected VersionsENISA

Linux patch: 6.18.35
Linux patch: 6.6.143
Linux 03f595668017f1a1fb971c02fc37140bc6e7bb1c <8c58a92849175f5e2ab7bc2734b3b89afe79f6ef
Linux patch: 0
Linux patch: 5.10.259
Linux 03f595668017f1a1fb971c02fc37140bc6e7bb1c <af24e202b543ded8a34f1d5d3db54eb916173f04
Linux 03f595668017f1a1fb971c02fc37140bc6e7bb1c <bd4be70669af55b974860d13680348cfdf50bbed
Linux 03f595668017f1a1fb971c02fc37140bc6e7bb1c <157ce2c6836ce0ff19108a819f38df061345425f
Linux 03f595668017f1a1fb971c02fc37140bc6e7bb1c <3bbe2bb9111ce6967a951bfac79af142d816fae5
Linux patch: 6.1.176
Linux 03f595668017f1a1fb971c02fc37140bc6e7bb1c <fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139
Linux patch: 5.15.210
Linux 3.8
Linux 03f595668017f1a1fb971c02fc37140bc6e7bb1c <a3cc795129e5ec0f8948653a3bf471e7d8852f5e
Linux patch: 7.0.12
Linux patch: 7.1
Linux 03f595668017f1a1fb971c02fc37140bc6e7bb1c <41058d4c3f63ab64901560a704882e0565f4e456
Linux patch: 6.12.93

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in the System V IPC layer (shared memory, semaphores, message queues) which maps IPC identifiers to kernel objects through an IDR radix tree. The checkpoint/restore-in-userspace (CRIU) feature exposes ids->next_id via a sysctl so a restored process can request a specific IPC id. ipc_idr_alloc() forwards this to idr_alloc() with a zero (open-ended) upper bound instead of clamping to ipc_mni, the maximum number of IPC ids. IPC ids are encoded as (seq << ipcmni_seq_shift()) + idx using a narrow index width; when allocation spills above that width, the index encoding and the actual IDR slot diverge. The root cause class is a use-after-free (CWE-416) arising from an off-range/improper-bounds allocation (CWE-787/CWE-129 family); the affected component is the generic ipc/util.c logic shared by shm, sem and msg. CPE data identifies the product as cpe:2.3:a:linux:linux, i.e. the upstream Linux kernel.

Know when Checkpoint gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 6.4 MEDIUM

Local-only via privileged checkpoint/restore path (AV:L, PR:H), and requires filling the IPC id tail to win the race (AC:H), but UAF yields full C/I/A impact.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 5.8 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 09:16 EUVD
CVE Published
Jun 24, 2026 - 07:14 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 07:14 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ipc: limit next_id allocation to the valid ID range

The checkpoint/restore sysctl path can request the next SysV IPC id through ids->next_id. ipc_idr_alloc() currently forwards that request to idr_alloc() with an open-ended upper bound.

If the valid tail of the SysV IPC id space is full, the allocation can spill beyond ipc_mni. The returned SysV IPC id still uses the normal index encoding, so later lookup and removal can target the wrong slot. This leaves the real IDR entry behind and breaks the IDR state for the object.

The bug is in ipc_idr_alloc() in the checkpoint/restore path.

  1. ids->next_id is passed to:

idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...)

  1. The zero upper bound makes the allocation effectively open-ended.

Once the valid SysV IPC tail is occupied, idr_alloc() can spill past ipc_mni and allocate an entry beyond the valid IPC id range.

  1. The new object id is still encoded with the narrower SysV IPC index

width:

new->id = (new->seq << ipcmni_seq_shift()) + idx

  1. Later removal goes through ipc_rmid(), which uses:

ipcid_to_idx(ipcp->id)

That truncates the real IDR index. An object actually stored at a high index can then be removed as if it lived at a low in-range index.

  1. For shared memory, shm_destroy() frees the current object anyway, but

the real high IDR slot is left behind as a dangling pointer.

  1. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry

and dereferences freed memory.

Prevent this by bounding the requested allocation to ipc_mni so the checkpoint/restore path fails once the valid range is exhausted.

Executive ViewAI

Why It Matters

A vulnerability in the Linux kernel's SysV IPC subsystem enables local privilege escalation and data exposure on affected systems. Organizations with untrusted local users or shared hosting environments face heightened risk of account compromise and sensitive information theft. While no active exploitation has been observed, the widespread deployment of Linux systems across enterprise and cloud infrastructure necessitates timely patching to prevent unauthorized access.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Ubiquitous
Linux kernel runs across the vast majority of server and container environments
Threat Intel
1
1 sources
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Checkpoint

View all
CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2024-24919 HIGH POC
8.6 May 28

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
CVE-2017-1000083 HIGH POC
7.8 Sep 05

backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
CVE-2026-85102 CRITICAL POC
9.8 Sep 09

Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
CVE-2026-16232 CRITICAL POC
9.3 Jul 22

Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
CVE-2026-50751 CRITICAL POC
9.3 Jun 08

Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
CVE-2026-93616 CRITICAL POC
9.8 Sep 22

Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory
CVE-2021-3449 MEDIUM
5.9 Mar 25

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
CVE-2026-85103 CRITICAL POC
9.8 Sep 09

Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
CVE-2026-91843 CRITICAL POC
9.8 Sep 16

Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overfl
CVE-2024-3568 CRITICAL POC
9.6 Apr 10

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data

Same weakness CWE-825 – Expired Pointer Dereference

View all
CVE-2025-49794 CRITICAL POC
9.1
CVE-2024-23310 CRITICAL POC
9.8
CVE-2025-49795 HIGH POC
7.5
CVE-2026-58592 HIGH POC
8.9
CVE-2019-15691 HIGH POC
7.2
CVE-2024-23638 MEDIUM POC
6.5
CVE-2026-53006 CRITICAL
9.8
CVE-2026-52924 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.168 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.149 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.197 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.145 Affected
Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:5.4.4.5.149 Affected
Container suse/sle-micro/base-5.5:2.0.4-5.8.296 Affected
Container suse/sle-micro/kvm-5.5:2.0.4-3.5.570 Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-295-16
Sources: Microsoft MSRC, CISA (public domain)

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-52923 ADVISORY https://seclists.org/oss-sec/2026/q3/665 ADVISORY https://seclists.org/oss-sec/2026/q3/678 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373184 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22511/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22512/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22521/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22522/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22665/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22666/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22699/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22742/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22769/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2799/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2800/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2840/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2841/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2914/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3044/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3089/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3156/ REF https://access.redhat.com/errata/RHSA-2026:47248 REF https://access.redhat.com/errata/RHSA-2026:48386 REF https://access.redhat.com/errata/RHSA-2026:49031 REF https://access.redhat.com/errata/RHSA-2026:49212 REF https://access.redhat.com/errata/RHSA-2026:49851 REF https://access.redhat.com/errata/RHSA-2026:49857 REF https://access.redhat.com/errata/RHSA-2026:51603 REF https://access.redhat.com/errata/RHSA-2026:51604 REF https://access.redhat.com/errata/RHSA-2026:52649 REF https://access.redhat.com/errata/RHSA-2026:52764 REF https://access.redhat.com/errata/RHSA-2026:53330 REF https://access.redhat.com/errata/RHSA-2026:61692 REF https://access.redhat.com/errata/RHSA-2026:63189 REF https://access.redhat.com/security/cve/CVE-2026-52923 REF https://bugzilla.redhat.com/show_bug.cgi?id=2492094 REF https://cert-portal.siemens.com/productcert/html/ssa-784472.html REF https://git.kernel.org/stable/c/157ce2c6836ce0ff19108a819f38df061345425f REF https://git.kernel.org/stable/c/3bbe2bb9111ce6967a951bfac79af142d816fae5 REF https://git.kernel.org/stable/c/41058d4c3f63ab64901560a704882e0565f4e456 REF https://git.kernel.org/stable/c/8c58a92849175f5e2ab7bc2734b3b89afe79f6ef REF https://git.kernel.org/stable/c/a3cc795129e5ec0f8948653a3bf471e7d8852f5e REF https://git.kernel.org/stable/c/af24e202b543ded8a34f1d5d3db54eb916173f04 REF https://git.kernel.org/stable/c/bd4be70669af55b974860d13680348cfdf50bbed REF https://git.kernel.org/stable/c/fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52923.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy