Vulnerability · Published Jun 24, 2026 · Assigned by Linux

CVE-2026-52993tipc: fix double-free in tipc_buf_append()

Critical 9.8

In plain English

A critical-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.4%top 65.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a pointer to a local variable which was a copy of the caller's skb pointer. If the skb was reallocated and validation subsequently failed, the error handling path would free the original skb pointer, which had already been freed, leading to double-free. Fix this by checking if head now points to a newly allocated reassembled skb. If it does, reassign *headbuf for later freeing operations.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8bpftool4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:10kernel6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-64k6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-64k5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-64k-core6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-64k-core5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-64k-debug6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-64k-debug5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-64k-debug-core6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-64k-debug-core5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-64k-debug-devel6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-64k-debug-devel5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-64k-debug-devel-matched6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-64k-debug-devel-matched5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-64k-debug-modules6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-64k-debug-modules5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-64k-debug-modules-core6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-64k-debug-modules-core5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-64k-debug-modules-extra6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-64k-debug-modules-extra5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-64k-devel6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-64k-devel5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-64k-devel-matched6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-64k-devel-matched5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-64k-modules6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-64k-modules5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-64k-modules-core6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-64k-modules-core5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-64k-modules-extra6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-64k-modules-extra5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-abi-stablelists6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-abi-stablelists4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-abi-stablelists5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-core6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-core4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-core5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-cross-headers6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-cross-headers4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-cross-headers5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-debug6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-debug4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-debug5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-debug-core6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-debug-core4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-debug-core5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-debug-devel6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-debug-devel4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-debug-devel5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-debug-devel-matched6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-debug-devel-matched5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-debug-modules6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-debug-modules4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-debug-modules5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-debug-modules-core6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-debug-modules-core5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-debug-modules-extra6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-debug-modules-extra4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-debug-modules-extra5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-debug-uki-virt6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-debug-uki-virt5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-devel6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-devel4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-devel5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-devel-matched6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-devel-matched5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-doc6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-doc4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-doc5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-headers6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-headers4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-headers5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-modules6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-modules4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-modules5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-modules-core6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-modules-core5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-modules-extra6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-modules-extra4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-modules-extra5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-modules-extra-matched6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:10kernel-rt6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-rt4.18.0-553.147.1.rt7.488.el8_10ALSA-2026:45116
AlmaLinux:9kernel-rt5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-64k6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-rt-64k5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-64k-core6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-rt-64k-core5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-64k-debug6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-rt-64k-debug5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-64k-debug-core6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-rt-64k-debug-core5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-64k-debug-devel6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-rt-64k-debug-devel5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-64k-debug-modules6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-rt-64k-debug-modules5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-64k-debug-modules-core6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-rt-64k-debug-modules-core5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-64k-debug-modules-extra6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-rt-64k-debug-modules-extra5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-64k-devel6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-rt-64k-devel5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-64k-modules6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-rt-64k-modules5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-64k-modules-core6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-rt-64k-modules-core5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-64k-modules-extra6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-rt-64k-modules-extra5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-core6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-rt-core4.18.0-553.147.1.rt7.488.el8_10ALSA-2026:45116
AlmaLinux:9kernel-rt-core5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-debug6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-rt-debug4.18.0-553.147.1.rt7.488.el8_10ALSA-2026:45116
AlmaLinux:9kernel-rt-debug5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-debug-core6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-rt-debug-core4.18.0-553.147.1.rt7.488.el8_10ALSA-2026:45116
AlmaLinux:9kernel-rt-debug-core5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-debug-devel6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-rt-debug-devel4.18.0-553.147.1.rt7.488.el8_10ALSA-2026:45116
AlmaLinux:9kernel-rt-debug-devel5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-debug-modules6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-rt-debug-modules4.18.0-553.147.1.rt7.488.el8_10ALSA-2026:45116
AlmaLinux:9kernel-rt-debug-modules5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-debug-modules-core6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-rt-debug-modules-core5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-debug-modules-extra6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-rt-debug-modules-extra4.18.0-553.147.1.rt7.488.el8_10ALSA-2026:45116
AlmaLinux:9kernel-rt-debug-modules-extra5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-devel6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-rt-devel4.18.0-553.147.1.rt7.488.el8_10ALSA-2026:45116
AlmaLinux:9kernel-rt-devel5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-modules6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-rt-modules4.18.0-553.147.1.rt7.488.el8_10ALSA-2026:45116
AlmaLinux:9kernel-rt-modules5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-modules-core6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-rt-modules-core5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-rt-modules-extra6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-rt-modules-extra4.18.0-553.147.1.rt7.488.el8_10ALSA-2026:45116
AlmaLinux:9kernel-rt-modules-extra5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-tools6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-tools4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-tools5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-tools-libs6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-tools-libs4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-tools-libs5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-tools-libs-devel6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-tools-libs-devel4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-tools-libs-devel5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-uki-virt6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-uki-virt5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-uki-virt-addons6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-uki-virt-addons5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-zfcpdump6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-zfcpdump4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-zfcpdump5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-zfcpdump-core6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-zfcpdump-core4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-zfcpdump-core5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-zfcpdump-devel6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-zfcpdump-devel4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-zfcpdump-devel5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-zfcpdump-devel-matched6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-zfcpdump-devel-matched5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-zfcpdump-modules6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-zfcpdump-modules4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-zfcpdump-modules5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-zfcpdump-modules-core6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9kernel-zfcpdump-modules-core5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10kernel-zfcpdump-modules-extra6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8kernel-zfcpdump-modules-extra4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9kernel-zfcpdump-modules-extra5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10libperf6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9libperf5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10perf6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8perf4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9perf5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10python3-perf6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:8python3-perf4.18.0-553.147.1.el8_10ALSA-2026:45115
AlmaLinux:9python3-perf5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10rtla6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9rtla5.14.0-687.33.1.el9_8ALSA-2026:49212
AlmaLinux:10rv6.12.0-211.40.1.el10_2ALSA-2026:47017
AlmaLinux:9rv5.14.0-687.33.1.el9_8ALSA-2026:49212
Debian:12linux6.1.176-1DEBIAN-CVE-2026-52993
Debian:13linux6.12.94-1DEBIAN-CVE-2026-52993
Debian:14linux7.0.10-1DEBIAN-CVE-2026-52993
Rocky Linux:10kernel0:6.12.0-211.40.1.el10_2RLSA-2026:47017
Rocky Linux:8kernel0:4.18.0-553.147.1.el8_10.cloud.0.1RXSA-2026:45115
Rocky Linux:8kernel0:4.18.0-553.147.1.el8_10RLSA-2026:45115
Rocky Linux:9kernel0:5.14.0-687.33.1.el9_8RLSA-2026:49212
Rocky Linux:8kernel-rt0:4.18.0-553.147.1.rt7.488.el8_10RLSA-2026:45116
Ubuntu:22.04:LTSlinux5.15.0-186.196UBUNTU-CVE-2026-52993
Ubuntu:24.04:LTSlinux6.8.0-136.136UBUNTU-CVE-2026-52993
Ubuntu:25.10linuxno fix listedUBUNTU-CVE-2026-52993
Ubuntu:26.04:LTSlinux7.0.0-28.28UBUNTU-CVE-2026-52993
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-52993
Ubuntu:22.04:LTSlinux-aws5.15.0-1112.119UBUNTU-CVE-2026-52993
Ubuntu:24.04:LTSlinux-aws6.8.0-1061.64UBUNTU-CVE-2026-52993
Ubuntu:25.10linux-awsno fix listedUBUNTU-CVE-2026-52993

Affected products (as reported)

VendorProductVersions
Linux Linux d618d09a68e4eed7a435beb2e355250f6f40664a – before a438975a6dcdbd70865978c021650d1485586f0bd618d09a68e4eed7a435beb2e355250f6f40664a – before 4ee4deadaae7cb2e3d53af0fc889cf92a73413c0d618d09a68e4eed7a435beb2e355250f6f40664a – before d3556656c6daebf8def751c7e71d11dd0a180d24d618d09a68e4eed7a435beb2e355250f6f40664a – before 0274f24485fc38032d4093e463dc3ff5c7a667c9d618d09a68e4eed7a435beb2e355250f6f40664a – before 4d104882bc815d4ec666ace9155f5f52715879a6d618d09a68e4eed7a435beb2e355250f6f40664a – before 1d5e589055880fae229e229e1929e087dbe08cf3d618d09a68e4eed7a435beb2e355250f6f40664a – before 29940fff14110ca48c5ccc168d121665b51bb778d618d09a68e4eed7a435beb2e355250f6f40664a – before d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3a
Linux Linux 4.15

Weakness: CWE-763 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References