Description
In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a pointer to a local variable which was a copy of the caller's skb pointer. If the skb was reallocated and validation subsequently failed, the error handling path would free the original skb pointer, which had already been freed, leading to double-free. Fix this by checking if head now points to a newly allocated reassembled skb. If it does, reassign *headbuf for later freeing operations.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d618d09a68e4eed7a435beb2e355250f6f40664a to < a438975a6dcdbd70865978c021650d1485586f0baffectedd618d09a68e4eed7a435beb2e355250f6f40664a to < 4ee4deadaae7cb2e3d53af0fc889cf92a73413c0affectedd618d09a68e4eed7a435beb2e355250f6f40664a to < d3556656c6daebf8def751c7e71d11dd0a180d24affectedd618d09a68e4eed7a435beb2e355250f6f40664a to < 0274f24485fc38032d4093e463dc3ff5c7a667c9affectedd618d09a68e4eed7a435beb2e355250f6f40664a to < 4d104882bc815d4ec666ace9155f5f52715879a6affectedd618d09a68e4eed7a435beb2e355250f6f40664a to < 1d5e589055880fae229e229e1929e087dbe08cf3affectedd618d09a68e4eed7a435beb2e355250f6f40664a to < 29940fff14110ca48c5ccc168d121665b51bb778affectedd618d09a68e4eed7a435beb2e355250f6f40664a to < d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3aaffected
Linux Linux
Default version status: affected
4.15affected0 to < 4.15unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.141 to ≤ 6.6.*unaffected6.12.91 to ≤ 6.12.*unaffected6.18.33 to ≤ 6.18.*unaffected7.0.10 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a438975a6dcdbd70865978c021650d1485586f0b ↗
- https://git.kernel.org/stable/c/4ee4deadaae7cb2e3d53af0fc889cf92a73413c0 ↗
- https://git.kernel.org/stable/c/d3556656c6daebf8def751c7e71d11dd0a180d24 ↗
- https://git.kernel.org/stable/c/0274f24485fc38032d4093e463dc3ff5c7a667c9 ↗
- https://git.kernel.org/stable/c/4d104882bc815d4ec666ace9155f5f52715879a6 ↗
- https://git.kernel.org/stable/c/1d5e589055880fae229e229e1929e087dbe08cf3 ↗
- https://git.kernel.org/stable/c/29940fff14110ca48c5ccc168d121665b51bb778 ↗
- https://git.kernel.org/stable/c/d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3a ↗
- https://access.redhat.com/security/cve/CVE-2026-52993 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2492437 ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52993.json ↗
- https://access.redhat.com/errata/RHSA-2026:47017 ↗
- https://access.redhat.com/errata/RHSA-2026:49212 ↗
- https://access.redhat.com/errata/RHSA-2026:45115 ↗
- https://access.redhat.com/errata/RHSA-2026:45116 ↗