CVE-2026-52993: tipc: fix double-free in tipc_buf_append()
In the Linux kernel, the following vulnerability has been resolved:
Other sources
tipc: fix double-free in tipcbufappend()
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.107-1Fixed in 7.1.8-2Fixed in 7.1.12-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.180-1~deb11u1
Event History
Frequently Asked Questions
What conditions trigger the double-free?
The issue occurs when tipc_msg_validate() reallocates the skb being validated and validation then fails. The error path in tipc_buf_append() can subsequently free the original skb pointer even though it was already freed during reallocation.
Does exploitation require local access, credentials, or user interaction?
The supplied CVSS vector rates the issue as network-reachable, low complexity, requiring no privileges and no user interaction. It also indicates potential high impact to confidentiality, integrity, and availability.
Which software is identified as affected?
The listed software includes the Linux kernel, Microsoft azl3 kernel 6.6.139.1-1, debian/linux, and debian/linux-6.1. The provided data does not identify affected or fixed version ranges for the general Linux kernel entries.