Loading vulnerability…
Double-free in Linux kernel TIPC tipc_buf_append()
CVE-2026-52993 is a double-free vulnerability in fragmented-message reassembly in the Linux kernel's TIPC subsystem. When processing the final fragment, tipc_buf_append() calls tipc_msg_validate() using a local copy of the caller's socket-buffer pointer. Validation can reallocate the buffer, freeing the original and updating only the local pointer. If validation subsequently fails, the error cleanup path frees the original buffer again through the stale caller pointer. An invalid TIPC header version can trigger failure after reallocation. The resulting kernel memory corruption can cause denial of service and potentially support further exploitation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Triggering the double-free can corrupt kernel memory or crash the kernel, disrupting the entire host and its workloads. More extensive compromise may be possible, but a demonstrated code-execution or privilege-escalation chain is not established. Exploit-availability statements attached to multi-vulnerability advisories do not establish exploit availability for this CVE specifically.
If you can’t patch tonight, do this now.
If TIPC is not required, unload the TIPC module and prevent it from being loaded automatically. This module-based workaround does not cover kernels with TIPC built in. Where TIPC must remain enabled, restrict access to configured TIPC bearers to trusted peers to reduce exposure to malicious fragmented messages. These measures do not replace the kernel update.
Patch, then assume compromise.
Install a vendor-supported kernel update containing the TIPC fix and reboot into the updated kernel. The fix synchronizes *headbuf with the replacement head pointer before error cleanup when validation has reallocated the buffer. Confirmed corrected RHEL releases include 4.18.0-305.208.1.el8_4 for the applicable RHEL 8.4 support streams, 4.18.0-372.216.1.el8_6 for RHEL 8.6, and 4.18.0-477.168.1.el8_8 for RHEL 8.8. Ubuntu 24.04 LTS OEM systems should install the applicable 6.17.0-1033.33 packages under USN-8911-1. For other platforms, use the corrected package build specified by the applicable vendor advisory. Rebuild third-party kernel modules where required by an ABI change.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
68 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.