CVE-2026-52923
Received Received - Intake
Linux kernel IPC ID Range Exhaustion Vulnerability

Publication date: 2026-06-24

Last updated on: 2026-06-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipc: limit next_id allocation to the valid ID range The checkpoint/restore sysctl path can request the next SysV IPC id through ids->next_id. ipc_idr_alloc() currently forwards that request to idr_alloc() with an open-ended upper bound. If the valid tail of the SysV IPC id space is full, the allocation can spill beyond ipc_mni. The returned SysV IPC id still uses the normal index encoding, so later lookup and removal can target the wrong slot. This leaves the real IDR entry behind and breaks the IDR state for the object. The bug is in ipc_idr_alloc() in the checkpoint/restore path. 1. ids->next_id is passed to: idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...) 2. The zero upper bound makes the allocation effectively open-ended. Once the valid SysV IPC tail is occupied, idr_alloc() can spill past ipc_mni and allocate an entry beyond the valid IPC id range. 3. The new object id is still encoded with the narrower SysV IPC index width: new->id = (new->seq << ipcmni_seq_shift()) + idx 4. Later removal goes through ipc_rmid(), which uses: ipcid_to_idx(ipcp->id) That truncates the real IDR index. An object actually stored at a high index can then be removed as if it lived at a low in-range index. 5. For shared memory, shm_destroy() frees the current object anyway, but the real high IDR slot is left behind as a dangling pointer. 6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry and dereferences freed memory. Prevent this by bounding the requested allocation to ipc_mni so the checkpoint/restore path fails once the valid range is exhausted.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-24
Last Modified
2026-06-24
Generated
2026-06-24
AI Q&A
2026-06-24
EPSS Evaluated
N/A
NVD
CVE-2026-52923
EUVD
EUVD-2026-38726
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's SysV IPC (Inter-Process Communication) ID allocation mechanism, specifically in the checkpoint/restore sysctl path. The function ipc_idr_alloc() requests the next IPC id without properly limiting the allocation range, allowing it to allocate IDs beyond the valid maximum (ipc_mni).

Because the allocation can spill beyond the valid ID range, the system encodes the new object ID with a narrower index width, causing later lookups and removals to target incorrect slots. This breaks the internal IDR (ID Radix Tree) state, leaving behind stale or dangling entries.

As a result, when shared memory objects are destroyed, the real high-index IDR slot remains as a dangling pointer. Subsequent operations, such as walking /proc/sysvipc/shm, may dereference freed memory, potentially leading to undefined behavior or system instability.

Impact Analysis

This vulnerability can lead to corruption of the internal IDR state in the Linux kernel's IPC subsystem. Specifically, it can cause stale or dangling pointers to remain in the IDR data structures.

Such corruption may result in the kernel dereferencing freed memory when accessing IPC shared memory information, which can cause system instability, crashes, or potentially allow attackers to exploit the kernel memory corruption for privilege escalation or denial of service.

Mitigation Strategies

To mitigate this vulnerability, ensure that the allocation of SysV IPC ids is bounded to the valid range ipc_mni. This prevents the checkpoint/restore path from allocating IDs beyond the valid range, which causes the issue.

Specifically, update or patch the Linux kernel to a version where ipc_idr_alloc() limits the next_id allocation to ipc_mni, so that the checkpoint/restore sysctl path fails once the valid range is exhausted.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52923. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart