by Kastro CVE-2026-52993
Linux Linux — tipc: fix double-free in tipc_buf_append()
Description · from the CVE record
In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a pointer to a local variable which was a copy of the caller's skb pointer. If the skb was reallocated and validation subsequently failed, the error handling path would free the original skb pointer, which had already been freed, leading to double-free. Fix this by checking if head now points to a newly allocated reassembled skb. If it does, reassign *headbuf for later freeing operations.
Affected
ProductAffectedFixed inSource
Linuxd618d09a68e4eed7a435beb2e355250f6f40664a – < a438975a6dcdbd70865978c021650d1485586f0ba438975a6dcdbd70865978c021650d1485586f0bCNA
Linuxd618d09a68e4eed7a435beb2e355250f6f40664a – < 4ee4deadaae7cb2e3d53af0fc889cf92a73413c04ee4deadaae7cb2e3d53af0fc889cf92a73413c0CNA
Linuxd618d09a68e4eed7a435beb2e355250f6f40664a – < d3556656c6daebf8def751c7e71d11dd0a180d24d3556656c6daebf8def751c7e71d11dd0a180d24CNA
Linuxd618d09a68e4eed7a435beb2e355250f6f40664a – < 0274f24485fc38032d4093e463dc3ff5c7a667c90274f24485fc38032d4093e463dc3ff5c7a667c9CNA
Linuxd618d09a68e4eed7a435beb2e355250f6f40664a – < 4d104882bc815d4ec666ace9155f5f52715879a64d104882bc815d4ec666ace9155f5f52715879a6CNA
Linuxd618d09a68e4eed7a435beb2e355250f6f40664a – < 1d5e589055880fae229e229e1929e087dbe08cf31d5e589055880fae229e229e1929e087dbe08cf3CNA
Linuxd618d09a68e4eed7a435beb2e355250f6f40664a – < 29940fff14110ca48c5ccc168d121665b51bb77829940fff14110ca48c5ccc168d121665b51bb778CNA
Linuxd618d09a68e4eed7a435beb2e355250f6f40664a – < d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3ad293ca716e7d5dffdaecaf6b9b2f857a33dc3d3aCNA
Linux4.15–CNA
Red Hat Enterprise Linux 10see advisory0:6.12.0-211.40.1.el10_2redhat-SADP
Red Hat Enterprise Linux 8see advisory0:4.18.0-553.147.1.rt7.488.el8_10redhat-SADP
Red Hat Enterprise Linux 8see advisory0:4.18.0-553.147.1.el8_10redhat-SADP
Scores by source
Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhat-SADP (CNA)7.0CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total