CVE-2026-52993 - Vulnerability Details

- tipc: fix double-free in tipc_buf_append()

Description

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix double-free in tipc_buf_append()

tipc_msg_validate() can potentially reallocate the skb it is validating,
freeing the old one. In tipc_buf_append(), it was being called with a
pointer to a local variable which was a copy of the caller's skb
pointer.

If the skb was reallocated and validation subsequently failed, the error
handling path would free the original skb pointer, which had already
been freed, leading to double-free.

Fix this by checking if head now points to a newly allocated reassembled
skb. If it does, reassign *headbuf for later freeing operations.

Published: 2026-06-24

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a double-free in the Linux kernel’s TIPC module, specifically in tipc_buf_append(). During validation, tipc_msg_validate may reallocate a socket buffer; if the allocation fails, the error path frees the original buffer again, corrupting kernel memory and potentially causing a crash.

Affected Systems

It affects all Linux kernel builds lacking the commit that introduced the fix. All distributions that ship an unpatched kernel containing the vulnerable TIPC code are impacted, regardless of specific kernel version.

Risk and Exploitability

With a CVSS score of 9.8, the flaw is considered critical; however, the EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not present in the CISA KEV catalog. The likely attack vector involves sending a crafted TIPC packet that triggers tipc_msg_validate, leading to a double-free and kernel crash, although the precise exploitation conditions are inferred from the description.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d618d09a68e4eed7a435beb2e355250f6f40664a`	affected	< a438975a6dcdbd70865978c021650d1485586f0b
`d618d09a68e4eed7a435beb2e355250f6f40664a`	affected	< 4ee4deadaae7cb2e3d53af0fc889cf92a73413c0
`d618d09a68e4eed7a435beb2e355250f6f40664a`	affected	< d3556656c6daebf8def751c7e71d11dd0a180d24
`d618d09a68e4eed7a435beb2e355250f6f40664a`	affected	< 0274f24485fc38032d4093e463dc3ff5c7a667c9
`d618d09a68e4eed7a435beb2e355250f6f40664a`	affected	< 4d104882bc815d4ec666ace9155f5f52715879a6
`d618d09a68e4eed7a435beb2e355250f6f40664a`	affected	< 1d5e589055880fae229e229e1929e087dbe08cf3
`d618d09a68e4eed7a435beb2e355250f6f40664a`	affected	< 29940fff14110ca48c5ccc168d121665b51bb778
`d618d09a68e4eed7a435beb2e355250f6f40664a`	affected	< d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3a

Linux

affected

Version	Status	Constraints
`4.15`	affected	—
`0`	unaffected	< 4.15
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.141`	unaffected	≤ 6.6.*
`6.12.91`	unaffected	≤ 6.12.*
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d618d09a68e4eed7a435beb2e355250f6f40664a,a438975a6dcdbd70865978c021650d1485586f0b)`	affected	code_commit	—
`[d618d09a68e4eed7a435beb2e355250f6f40664a,4ee4deadaae7cb2e3d53af0fc889cf92a73413c0)`	affected	code_commit	—
`[d618d09a68e4eed7a435beb2e355250f6f40664a,d3556656c6daebf8def751c7e71d11dd0a180d24)`	affected	code_commit	—
`[d618d09a68e4eed7a435beb2e355250f6f40664a,0274f24485fc38032d4093e463dc3ff5c7a667c9)`	affected	code_commit	—
`[d618d09a68e4eed7a435beb2e355250f6f40664a,4d104882bc815d4ec666ace9155f5f52715879a6)`	affected	code_commit	—
`[d618d09a68e4eed7a435beb2e355250f6f40664a,1d5e589055880fae229e229e1929e087dbe08cf3)`	affected	code_commit	—
`[d618d09a68e4eed7a435beb2e355250f6f40664a,29940fff14110ca48c5ccc168d121665b51bb778)`	affected	code_commit	—
`[d618d09a68e4eed7a435beb2e355250f6f40664a,d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3a)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.15`	affected	generic	—
`[0,4.15)`	unaffected	generic	—
`[5.10.258,5.11.0)`	unaffected	semver	—
`[5.15.209,5.16.0)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.141,6.7.0)`	unaffected	semver	—
`[6.12.91,6.13.0)`	unaffected	semver	—
`[6.18.33,6.19.0)`	unaffected	semver	—
`[7.0.10,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a Linux kernel version that includes the commit fixing the double-free, as documented in the official advisory references.
If the vendor does not provide an immediate patch, apply the patch from the referenced commits to the local kernel source, rebuild, and install the updated kernel image.
Where updating is infeasible, restrict or disable TIPC network services to reduce exposure, and monitor system logs for kernel Oops or crash events that may indicate unresolved issues.

Generated by OpenCVE AI on June 28, 2026 at 13:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4664-1	linux security update
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00351.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0274f24485fc38032d4093e463dc3ff5c7a667c9
https://git.kernel.org/stable/c/1d5e589055880fae229e229e1929e087dbe08cf3
https://git.kernel.org/stable/c/29940fff14110ca48c5ccc168d121665b51bb778
https://git.kernel.org/stable/c/4d104882bc815d4ec666ace9155f5f52715879a6
https://git.kernel.org/stable/c/4ee4deadaae7cb2e3d53af0fc889cf92a73413c0
https://git.kernel.org/stable/c/a438975a6dcdbd70865978c021650d1485586f0b
https://git.kernel.org/stable/c/d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3a
https://git.kernel.org/stable/c/d3556656c6daebf8def751c7e71d11dd0a180d24
https://lore.kernel.org/linux-cve-announce/2026062445-CVE-2026-52993-34a2@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-52993
https://www.cve.org/CVERecord?id=CVE-2026-52993

History

Sun, 28 Jun 2026 08:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Fri, 26 Jun 2026 02:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-415

Fri, 26 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-763
References		https://lore.kernel.org/linux-cve-announce/2026062445-CVE-2026-52993-34a2@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-52993 https://www.cve.org/CVERecord?id=CVE-2026-52993
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Wed, 24 Jun 2026 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-415

Wed, 24 Jun 2026 17:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a pointer to a local variable which was a copy of the caller's skb pointer. If the skb was reallocated and validation subsequently failed, the error handling path would free the original skb pointer, which had already been freed, leading to double-free. Fix this by checking if head now points to a newly allocated reassembled skb. If it does, reassign *headbuf for later freeing operations.
Title		tipc: fix double-free in tipc_buf_append()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0274f24485fc38032d4093e463dc3ff5c7a667c9 https://git.kernel.org/stable/c/1d5e589055880fae229e229e1929e087dbe08cf3 https://git.kernel.org/stable/c/29940fff14110ca48c5ccc168d121665b51bb778 https://git.kernel.org/stable/c/4d104882bc815d4ec666ace9155f5f52715879a6 https://git.kernel.org/stable/c/4ee4deadaae7cb2e3d53af0fc889cf92a73413c0 https://git.kernel.org/stable/c/a438975a6dcdbd70865978c021650d1485586f0b https://git.kernel.org/stable/c/d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3a https://git.kernel.org/stable/c/d3556656c6daebf8def751c7e71d11dd0a180d24

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-24T16:29:06.475Z

Updated: 2026-06-30T12:09:39.515Z

Reserved: 2026-06-09T07:44:35.377Z

Link: CVE-2026-52993

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Important

Publid Date: 2026-06-24T00:00:00Z

Links: CVE-2026-52993 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-28T13:15:16Z

Weaknesses

CWE-763
Release of Invalid Pointer or Reference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object