CVE-2026-52993

Analyzed Analyzed - Analysis Complete

Double-Free in Linux Kernel TIPC Module

Publication date: 2026-06-24

Last updated on: 2026-07-15

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a pointer to a local variable which was a copy of the caller's skb pointer. If the skb was reallocated and validation subsequently failed, the error handling path would free the original skb pointer, which had already been freed, leading to double-free. Fix this by checking if head now points to a newly allocated reassembled skb. If it does, reassign *headbuf for later freeing operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-15

Generated

2026-07-15

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-52993

EUVD

EUVD-2026-38861

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.2 (inc) to 6.6.141 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.91 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.33 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 4.15 (inc) to 5.10.258 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-415	The product calls free() twice on the same memory address.
CWE-763	The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem, specifically in the tipc_buf_append() function.

The issue arises because tipc_msg_validate() can reallocate the skb (socket buffer) it is validating, freeing the old skb. However, tipc_buf_append() was calling tipc_msg_validate() with a pointer to a local copy of the skb pointer.

If the skb was reallocated and validation failed afterward, the error handling code would free the original skb pointer again, which had already been freed, causing a double-free vulnerability.

The fix involved checking if the head pointer now points to a newly allocated skb and, if so, reassigning the headbuf pointer for proper freeing later, preventing the double-free.

Impact Analysis

A double-free vulnerability in the Linux kernel can lead to serious security issues such as system crashes, memory corruption, or potentially arbitrary code execution.

Exploitation of this vulnerability could allow an attacker to destabilize the system or escalate privileges, depending on the context in which the vulnerability is triggered.

Mitigation Strategies

To mitigate this vulnerability, you should update your Linux kernel to a version where the double-free issue in tipc_buf_append() has been fixed.

The fix involves proper handling of skb pointers in the tipc_msg_validate() and tipc_buf_append() functions to prevent double-free errors.

Applying the latest kernel patches or upgrading to a kernel version released after 2026-06-24 is recommended.

Hi! I’m here to help you understand CVE-2026-52993. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70