Loading story…
A double-free vulnerability tracked as CVE-2026-52993 was disclosed in the Linux kernel's Transparent Inter-Process Communication (TIPC) subsystem, specifically in tipc_buf_append() within net/tipc/msg.c. The bug occurs when tipc_msg_validate() reallocates a socket buffer, frees the original buffer, and subsequent error handling frees the stale pointer again, creating conditions for system instability, denial of service, and possible arbitrary code execution in some scenarios. The flaw affects code introduced in kernel 4.15, and the Linux kernel CVE team said it was fixed across multiple stable and mainline branches.
Red Hat rated the issue Important with a CVSS v3 score of 7.0 and said fixes were released through security errata for Red Hat Enterprise Linux 8, 9, and 10 kernel packages. At the time of Red Hat's advisory, RHEL 9 kernel-rt remained affected, while RHEL 6 and 7 kernel variants were not impacted because the vulnerable code was absent. Upstream maintainers advised organizations to update to the latest stable kernel releases rather than cherry-picking individual patches.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2026:47017 to fix CVE-2026-52993 in Red Hat Enterprise Linux 10 kernel packages. The issue remained listed as affecting RHEL 9 kernel-rt at the time of the entry.
Red Hat shipped fixes for CVE-2026-52993 for Red Hat Enterprise Linux 8 kernel via RHSA-2026:45115 and RHEL 8 kernel-rt via RHSA-2026:45116. Red Hat rated the flaw Important severity.
The Linux kernel CVE announcement documented fixes for CVE-2026-52993 in versions 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, and 7.1. The fix updates pointer handling so later frees use the correct reallocated skb.
The Linux kernel CVE team assigned CVE-2026-52993 to a double-free vulnerability in the TIPC subsystem's tipc_buf_append(). The bug can occur when tipc_msg_validate() reallocates an skb and later error handling frees the stale pointer again.
Red Hat released RHSA-2026:49212 to address CVE-2026-52993 in Red Hat Enterprise Linux 9 kernel packages. Red Hat continued to list RHEL 9 kernel-rt as affected.
The vulnerable code path for CVE-2026-52993 was introduced in Linux kernel 4.15 via commit d618d09a68e4eed7a435beb2e355250f6f40664a. The flaw affects the TIPC subsystem's tipc_buf_append() handling after skb reallocation.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released updated Linux kernel and real-time kernel packages for supported RHEL 8 and RHEL 9 service streams to remediate **CVE-2025-38464** and **CVE-2025-38085**. CVE-2025-38464 is a use-after-free in TIPC topology-server connection teardown: a race between `tipc_topsrv_stop()` and receive-work handling can release a connection’s final reference before `tipc_conn_close()` completes. CVE-2025-38085 affects hugetlb memory management, where a race between `huge_pmd_unshare()` and GUP-fast can cause a page-table walk to traverse another process’s page tables; upstream reported no immediate kernel-memory-corruption path. The fixes retain TIPC connection references through close processing and synchronize removal of shared huge-page tables with an IPI. Affected offerings include RHEL 8.4, 8.8, 8.10 and RHEL 9.2 variants, including SAP, telecommunications, AUS, EUS, ELC, and Real Time deployments; examples include kernel `4.18.0-477.108.1.el8_8`, `4.18.0-305.172.1.el8_4`, and `5.14.0-284.136.1.el9_2`. Administrators should apply the applicable Red Hat security updates and reboot systems to load the patched kernel.
Aug 26, 2026
Red Hat released Important Linux kernel updates for Red Hat Enterprise Linux 9 to remediate multiple security flaws, including **CVE-2025-38052**, a use-after-free read in the TIPC networking subsystem. The flaw occurs when asynchronous encryption work accesses TIPC cryptographic state after it has been freed during network-namespace deletion; the upstream fix preserves a network-namespace reference until encryption processing finishes. The RHSA-2025:12746 update also addresses other kernel use-after-free issues, an integer-overflow vulnerability in CIFS processing, and an information-disclosure flaw in VMware VMCI datagram handling. Affected RHEL 9 systems include x86_64, ARM64, IBM Z, and Power little-endian deployments across standard, EUS, ELS, SAP, AUS, and CodeReady Linux Builder offerings; Red Hat also issued fixes for CVE-2025-38052 in supported RHEL 8 and RHEL 10 variants. Organizations should apply the appropriate kernel updates and reboot systems for the fixes to take effect.
Aug 26, 2026
Red Hat addressed **CVE-2020-36516**, a moderate-severity Linux kernel TCP/IP flaw that can let an off-path attacker inject data into an active TCP session or terminate it. The issue arises from interactions between mixed and hash-based IPID assignment, enabling packet spoofing through IP fragmentation and IPID collisions; successful exploitation requires a complex scenario and is considered more likely on a local network. Red Hat assigned a CVSS v3.1 score of 5.9, while upstream Linux fixed the vulnerability in kernel `5.17-rc2`. The fix was delivered for supported RHEL 8 and RHEL 9 kernel and real-time kernel packages, including through **RHSA-2024:2674** for RHEL 8.6 extended-support channels. That advisory also remediates `CVE-2024-26586` in the mlxsw Spectrum ACL TCAM component and applies across x86_64, s390x, ppc64le, and aarch64 offerings. Organizations should install the applicable kernel errata and reboot affected systems; Red Hat lists no qualifying mitigation, and RHEL 6 and RHEL 7 are outside support scope.
Aug 26, 2026