CVE-2026-52993
criticalpriority · track · 10EPSS 0.004 · 34 %ileexploit · PoCDEEUFRRUUSEPSS · scored 2026-10-25
In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a pointer to a local variable which was a copy of the caller's skb pointer. If the skb was reallocated and validation subsequently failed, the error handling path would free the original skb pointer, which had already been freed, leading to double-free. Fix this by checking if head now points to a newly allocated reassembled skb. If it does, reassign *headbuf for later freeing operations.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
affected products (68)
Products and version ranges known to be affected.
advisories (5)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-2077Linux Kernel: Mehrere SchwachstellenDeutsch2026-06-24csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen und weitere, nicht näher spezifizierte Auswirkungen zu erzielen.
- WID-SEC-W-2026-3043IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2026-08-26csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen und um beliebigen Programmcode auszuführen.
- WID-SEC-W-2026-3251Android Patchday September 2026: Mehrere SchwachstellenDeutsch2026-09-08csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, vertrauliche Informationen offenzulegen oder Denial-of-Service-Zustände herbeizuführen.
- ASB-A-5000227992026-09-01vendor · osvUS
In tipc_buf_append of msg.c, there is a possible remote code execution due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- CERTFR-2026-AVI-1333Multiples vulnérabilités dans le noyau Linux d'UbuntuFrançais2026-10-16vendor · certfrFR
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (32)
External citations — patches, advisories, analysis.
- https://git.kernel.org/stable/c/0274f24485fc38032d4093e463dc3ff5c7a667c9cnnvd
- https://git.kernel.org/stable/c/1d5e589055880fae229e229e1929e087dbe08cf3cnnvd
- https://git.kernel.org/stable/c/29940fff14110ca48c5ccc168d121665b51bb778cnnvd
- https://git.kernel.org/stable/c/4d104882bc815d4ec666ace9155f5f52715879a6cnnvd
- https://git.kernel.org/stable/c/4ee4deadaae7cb2e3d53af0fc889cf92a73413c0cnnvd
- https://git.kernel.org/stable/c/a438975a6dcdbd70865978c021650d1485586f0bcnnvd
- https://git.kernel.org/stable/c/d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3acnnvd
- https://git.kernel.org/stable/c/d3556656c6daebf8def751c7e71d11dd0a180d24cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan