Linux Kernel TIPC Double-Free Flaw Patched Across Stable Releases

A double-free vulnerability tracked as CVE-2026-52993 was disclosed in the Linux kernel's Transparent Inter-Process Communication (TIPC) subsystem, specifically in tipc_buf_append() within net/tipc/msg.c. The bug occurs when tipc_msg_validate() reallocates a socket buffer, frees the original buffer, and subsequent error handling frees the stale pointer again, creating conditions for system instability, denial of service, and possible arbitrary code execution in some scenarios. The flaw affects code introduced in kernel 4.15, and the Linux kernel CVE team said it was fixed across multiple stable and mainline branches.

Red Hat rated the issue Important with a CVSS v3 score of 7.0 and said fixes were released through security errata for Red Hat Enterprise Linux 8, 9, and 10 kernel packages. At the time of Red Hat's advisory, RHEL 9 kernel-rt remained affected, while RHEL 6 and 7 kernel variants were not impacted because the vulnerable code was absent. Upstream maintainers advised organizations to update to the latest stable kernel releases rather than cherry-picking individual patches.