CVE-2026-52993: tipc: fix double-free in tipc_buf_append()
In the Linux kernel, the following vulnerability has been resolved:
Other sources
In tipcbufappend of msg.c, there is a possible remote code execution due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
— OSV
tipc: fix double-free in tipcbufappend()
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.107-1Fixed in 7.1.8-2Fixed in 7.1.12-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.180-1~deb11u1 - Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2026-09-05 - Compensating control
Modify tipc_buf_append() to check whether head points to a newly allocated reassembled skb and, if so, reassign *headbuf to that skb before later freeing operations, preventing the error path from freeing the original skb pointer after it has been freed.
Event History
Frequently Asked Questions
What conditions trigger the double-free?
The issue occurs when tipc_msg_validate() reallocates the skb being validated and validation then fails. The error path in tipc_buf_append() can subsequently free the original skb pointer even though it was already freed during reallocation.
Does exploitation require local access, credentials, or user interaction?
The supplied CVSS vector rates the issue as network-reachable, low complexity, requiring no privileges and no user interaction. It also indicates potential high impact to confidentiality, integrity, and availability.
Which software is identified as affected?
The listed software includes the Linux kernel, Microsoft azl3 kernel 6.6.139.1-1, debian/linux, and debian/linux-6.1. The provided data does not identify affected or fixed version ranges for the general Linux kernel entries.