Fedora Account System
Red Hat Associate
Red Hat Customer
In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a pointer to a local variable which was a copy of the caller's skb pointer. If the skb was reallocated and validation subsequently failed, the error handling path would free the original skb pointer, which had already been freed, leading to double-free. Fix this by checking if head now points to a newly allocated reassembled skb. If it does, reassign *headbuf for later freeing operations.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2026062445-CVE-2026-52993-34a2@gregkh/T
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:45115 https://access.redhat.com/errata/RHSA-2026:45115
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:45116 https://access.redhat.com/errata/RHSA-2026:45116
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:47017 https://access.redhat.com/errata/RHSA-2026:47017
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:49212 https://access.redhat.com/errata/RHSA-2026:49212
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:69837 https://access.redhat.com/errata/RHSA-2026:69837
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:69874 https://access.redhat.com/errata/RHSA-2026:69874
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:69906 https://access.redhat.com/errata/RHSA-2026:69906
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:70483 https://access.redhat.com/errata/RHSA-2026:70483
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:70482 https://access.redhat.com/errata/RHSA-2026:70482
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:73645 https://access.redhat.com/errata/RHSA-2026:73645
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:74174 https://access.redhat.com/errata/RHSA-2026:74174
Additional information: a public LPE PoC for CVE-2026-52993 has now been released. PoC: https://github.com/captainai-labs/captainai-lpe-cve-2026-52993 The published exploit demonstrates that the TIPC double-free in tipc_buf_append() can be turned into a local privilege escalation from an unprivileged user (uid 1000) to root. The repository provides evidence of: - successful uid 1000 -> uid 0 privilege escalation - repeated successful local LPE runs on Linux 6.6.140 - a fixed-kernel control using Linux 6.6.141 where escalation fails - unauthenticated remote triggering of the underlying memory corruption via a configured TIPC UDP bearer The currently published LPE chain uses laboratory-specific conditions, including SMAP being disabled, so this does not necessarily mean that the exploit is directly portable to a default RHEL configuration. The fixes for CVE-2026-52993 have already been released, so no additional fix is being requested. For systems where TIPC is not required, an additional mitigation is to prevent the TIPC kernel module from loading: echo "install tipc /bin/true" > /etc/modprobe.d/disable-tipc.conf Since practical uid 1000 -> root exploitation has now been publicly demonstrated, could Red Hat Product Security please review whether the current vulnerability description and CVSS assessment still accurately reflect the exploitability of this issue, particularly the current AC:H rating? Current Red Hat assessment: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H This report is intended as additional exploitability information for the existing CVE rather than a request for a new fix.
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:75560 https://access.redhat.com/errata/RHSA-2026:75560