CVE-2026-52943
published 2026-06-24CVE-2026-52943: In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zerocopy reference in pskb_carve helpers…
PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.24%
14.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: fix missing zerocopy reference in pskb_carve helpers
pskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy
the old skb_shared_info header into a new buffer via memcpy(), which
includes the destructor_arg pointer (uarg) for MSG_ZEROCOPY skbs.
Neither function calls net_zcopy_get() for the new shinfo, creating an
unaccounted holder: every skb_shared_info with destructor_arg set will
call skb_zcopy_clear() once when freed, but the corresponding
net_zcopy_get() was never called for the new copy. Repeated calls
drive uarg->refcnt to zero prematurely, freeing ubuf_info_msgzc while
TX skbs still hold live destructor_arg pointers.
KASAN reports use-after-free on a freed ubuf_info_msgzc:
BUG: KASAN: slab-use-after-free in skb_release_data+0x77b/0x810
Read of size 8 at addr ffff88801574d3e8 by task poc/220
Call Trace:
skb_release_data+0x77b/0x810
kfree_skb_list_reason+0x13e/0x610
skb_release_data+0x4cd/0x810
sk_skb_reason_drop+0xf3/0x340
skb_queue_purge_reason+0x282/0x440
rds_tcp_inc_free+0x1e/0x30
rds_recvmsg+0x354/0x1780
__sys_recvmsg+0xdf/0x180
Allocated by task 219:
msg_zerocopy_realloc+0x157/0x7b0
tcp_sendmsg_locked+0x2892/0x3ba0
Freed by task 219:
ip_recv_error+0x74a/0xb10
tcp_recvmsg+0x475/0x530
The skb consuming the late access still referenced the same uarg via
shinfo->destructor_arg copied by pskb_carve_inside_nonlinear() without
a refcount bump. This has been verified to be reliably exploitable: a
working proof-of-concept achieves full root privilege escalation from
an unprivileged local user on a default kernel configuration.
The fix follows the pattern of pskb_expand_head() which has the same
memcpy/cloned structure. For pskb_carve_inside_header(), net_zcopy_get()
is placed after skb_orphan_frags() succeeds, so the orphan error path
needs no cleanup. For pskb_carve_inside_nonlinear(), net_zcopy_get() is
placed after all failure points and just before skb_rel
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 6fa01ccd883021105e9f8af7d04b9f156fa3494a < 8dbed691e43a50903658130bde0fcb5abc425b37 | 8dbed691e43a50903658130bde0fcb5abc425b37 |
| linux | linux | >= 6fa01ccd883021105e9f8af7d04b9f156fa3494a < 9b40bdc2a3298225dffab8158208a0d8c6300578 | 9b40bdc2a3298225dffab8158208a0d8c6300578 |
| linux | linux | >= 6fa01ccd883021105e9f8af7d04b9f156fa3494a < fd470f0a97b8e9a125f520265d2f3b088ffb5b8a | fd470f0a97b8e9a125f520265d2f3b088ffb5b8a |
| linux | linux | >= 6fa01ccd883021105e9f8af7d04b9f156fa3494a < ceafb893b12f23331dcc5ff9587e643c3a40ee9f | ceafb893b12f23331dcc5ff9587e643c3a40ee9f |
| linux | linux | >= 6fa01ccd883021105e9f8af7d04b9f156fa3494a < 2e0e74c59b2761a414d9f48d7bee1e45220b2427 | 2e0e74c59b2761a414d9f48d7bee1e45220b2427 |
| linux | linux | >= 6fa01ccd883021105e9f8af7d04b9f156fa3494a < 96a4713ae041cc85e712bac682cd2e644004d6c6 | 96a4713ae041cc85e712bac682cd2e644004d6c6 |
| linux | linux | >= 6fa01ccd883021105e9f8af7d04b9f156fa3494a < 474d6c771d798bca84f0a140b611e36743511e18 | 474d6c771d798bca84f0a140b611e36743511e18 |
| linux | linux | >= 6fa01ccd883021105e9f8af7d04b9f156fa3494a < 98d0912e9f841e5529a5b89a972805f34cb1c69d | 98d0912e9f841e5529a5b89a972805f34cb1c69d |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 4.7 < 5.10.259 | 5.10.259 |
| linux | linux_kernel | >= 5.11 < 5.15.210 | 5.15.210 |
| linux | linux_kernel | >= 5.16 < 6.1.176 | 6.1.176 |
| linux | linux_kernel | >= 6.13 < 6.18.35 | 6.18.35 |
| linux | linux_kernel | >= 6.19 < 7.0.12 | 7.0.12 |
| linux | linux_kernel | >= 6.2 < 6.6.143 | 6.6.143 |
| linux | linux_kernel | >= 6.7 < 6.12.93 | 6.12.93 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 7.0.11 net pskb_carve_inside_header refcnt use after free (Nessus ID 323963)
vuldb·2026-07-01·CVSS 7.8
CVE-2026-52943 [HIGH] Linux Kernel up to 7.0.11 net pskb_carve_inside_header refcnt use after free (Nessus ID 323963)
A vulnerability described as critical has been identified in Linux Kernel up to 7.0.11. This affects the function pskb_carve_inside_header of the component net. Such manipulation of the argument refcnt leads to use after free.
This vulnerability is listed as CVE-2026-52943. The attack must be carried out locally. There is no available exploit.
Upgrading the affected component is recommended.
GHSA
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zerocopy reference in pskb_carve helpers pskb_carve_inside_header() and pskb_carve_inside_nonlinear() bot
ghsa_unreviewed·2026-06-24
CVE-2026-52943 In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zerocopy reference in pskb_carve helpers pskb_carve_inside_header() and pskb_carve_inside_nonlinear() bot
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: fix missing zerocopy reference in pskb_carve helpers
pskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy
the old skb_shared_info header into a new buffer via memcpy(), which
includes the destructor_arg pointer (uarg) for MSG_ZEROCOPY skbs.
Neither function calls net_zcopy_get() for the new shinfo, creating an
unaccounted holder: every skb_shared_info with destructor_arg set will
call skb_zcopy_clear() once when freed, but the corresponding
net_zcopy_get() was never called for the new copy. Repeated calls
drive uarg->refcnt to zero prematurely, freeing ubuf_info_msgzc while
TX skbs still hold live destructor_arg pointers.
KASAN reports use-after-free on a freed ubuf_info_msgzc:
BUG: KASAN
Red Hat
kernel: net: skbuff: fix missing zerocopy reference in pskb_carve helpers
vendor_redhat·2026-06-24·CVSS 7.0
CVE-2026-52943 [HIGH] CWE-911 kernel: net: skbuff: fix missing zerocopy reference in pskb_carve helpers
kernel: net: skbuff: fix missing zerocopy reference in pskb_carve helpers
A flaw was found in the Linux kernel. The `pskb_carve_inside_header()` and `pskb_carve_inside_nonlinear()` helper functions, which handle network packet buffers, do not correctly account for zero-copy references. This oversight can lead to a use-after-free vulnerability, where memory is prematurely released while still in use. A local unprivileged user can exploit this flaw to achieve full root privilege escalation on the system.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Under investigation
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Lin
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/2e0e74c59b2761a414d9f48d7bee1e45220b2427https://git.kernel.org/stable/c/474d6c771d798bca84f0a140b611e36743511e18https://git.kernel.org/stable/c/8dbed691e43a50903658130bde0fcb5abc425b37https://git.kernel.org/stable/c/96a4713ae041cc85e712bac682cd2e644004d6c6https://git.kernel.org/stable/c/98d0912e9f841e5529a5b89a972805f34cb1c69dhttps://git.kernel.org/stable/c/9b40bdc2a3298225dffab8158208a0d8c6300578https://git.kernel.org/stable/c/ceafb893b12f23331dcc5ff9587e643c3a40ee9fhttps://git.kernel.org/stable/c/fd470f0a97b8e9a125f520265d2f3b088ffb5b8ahttps://access.redhat.com/security/cve/CVE-2026-52943https://bugzilla.redhat.com/show_bug.cgi?id=2492137https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52943.json
2026-06-24
Published