{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-52923 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-52923 is a high-severity use after free vulnerability in Linux kernel, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-52923 and fix it if it is affected.\n\nWhat it is: CVE-2026-52923 is a high-severity use after free vulnerability in Linux kernel, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-52923 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-52923/ (Markdown: https://insights.sbomify.com/CVE-2026-52923/index.md)","id":"CVE-2026-52923","markdown":"https://insights.sbomify.com/CVE-2026-52923/index.md","name":"CVE-2026-52923","record":{"aliases":["ALSA-2026:49851","ALSA-2026:49857","AZL-90638","BELL-CVE-2026-52923","DEBIAN-CVE-2026-52923","GHSA-m237-4jxg-w5jh","RHSA-2026:49851","RHSA-2026:49857","RLSA-2026:49851","RLSA-2026:49857","ROOT-OS-DEBIAN-11-CVE-2026-52923","ROOT-OS-DEBIAN-12-CVE-2026-52923","ROOT-OS-UBUNTU-2204-CVE-2026-52923","ROOT-OS-UBUNTU-2404-CVE-2026-52923","RXSA-2026:49857","UBUNTU-CVE-2026-52923"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Linux kernel IPC","requires_auth":"low_privilege","summary":"A Linux kernel IPC bug allows attackers to trigger a use-after-free via checkpoint/restore, potentially leading to code execution or system crashes.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-401","name":"Missing Release of Memory after Effective Lifetime"},{"id":"CWE-825","name":"Expired Pointer Dereference"},{"id":"CWE-20","name":"Improper Input Validation"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipc: limit next_id allocation to the valid ID range\n\nThe checkpoint/restore sysctl path can request the next SysV IPC id\nthrough ids-\u003enext_id.  ipc_idr_alloc() currently forwards that request to\nidr_alloc() with an open-ended upper bound.\n\nIf the valid tail of the SysV IPC id space is full, the allocation can\nspill beyond ipc_mni.  The returned SysV IPC id still uses the normal\nindex encoding, so later lookup and removal can target the wrong slot. \nThis leaves the real IDR entry behind and breaks the IDR state for the\nobject.\n\nThe bug is in ipc_idr_alloc() in the checkpoint/restore path.\n\n1. ids-\u003enext_id is passed to:\n\n       idr_alloc(\u0026ids-\u003eipcs_idr, new, ipcid_to_idx(next_id), 0, ...)\n\n2. The zero upper bound makes the allocation effectively open-ended.\n   Once the valid SysV IPC tail is occupied, idr_alloc() can spill past\n   ipc_mni and allocate an entry beyond the valid IPC id range.\n\n3. The new object id is still encoded with the narrower SysV IPC index\n   width:\n\n       new-\u003eid = (new-\u003eseq \u003c\u003c ipcmni_seq_shift()) + idx\n\n4. Later removal goes through ipc_rmid(), which uses:\n\n       ipcid_to_idx(ipcp-\u003eid)\n\n   That truncates the real IDR index. An object actually stored at a\n   high index can then be removed as if it lived at a low in-range\n   index.\n\n5. For shared memory, shm_destroy() frees the current object anyway, but\n   the real high IDR slot is left behind as a dangling pointer.\n\n6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry\n   and dereferences freed memory.\n\nPrevent this by bounding the requested allocation to ipc_mni so the\ncheckpoint/restore path fails once the valid range is exhausted.","ecosystems":["AlmaLinux:8","Red Hat:enterprise_linux:8::baseos","Red Hat:enterprise_linux:8::crb","Red Hat:enterprise_linux:8::nfv","Red Hat:enterprise_linux:8::realtime","Rocky Linux:8"],"exploits":{"exploitdb":0,"first_seen":"2026-08-28","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-08-28T07:37:22Z","kind":"github_poc","ref":"https://github.com/Hari-v542/CVE-2026-52923","stars":0,"title":null}],"tier":"poc_unverified"},"has_fix":true,"headline":"ipc: limit next_id allocation to the valid ID range","id":"CVE-2026-52923","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"use_after_free","year":"2026"},"n_packages":109,"n_references":8,"next":{"headline":"sctp: purge outqueue on stale COOKIE-ECHO handling","id":"CVE-2026-52924"},"packages":[{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"bpftool","purl":"pkg:rpm/almalinux/bpftool","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel","purl":"pkg:rpm/almalinux/kernel","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-abi-stablelists","purl":"pkg:rpm/almalinux/kernel-abi-stablelists","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-core","purl":"pkg:rpm/almalinux/kernel-core","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-cross-headers","purl":"pkg:rpm/almalinux/kernel-cross-headers","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-debug","purl":"pkg:rpm/almalinux/kernel-debug","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-core","purl":"pkg:rpm/almalinux/kernel-debug-core","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-devel","purl":"pkg:rpm/almalinux/kernel-debug-devel","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-modules","purl":"pkg:rpm/almalinux/kernel-debug-modules","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-modules-extra","purl":"pkg:rpm/almalinux/kernel-debug-modules-extra","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-devel","purl":"pkg:rpm/almalinux/kernel-devel","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-doc","purl":"pkg:rpm/almalinux/kernel-doc","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-headers","purl":"pkg:rpm/almalinux/kernel-headers","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-modules","purl":"pkg:rpm/almalinux/kernel-modules","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-modules-extra","purl":"pkg:rpm/almalinux/kernel-modules-extra","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.rt7.492.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-rt","purl":"pkg:rpm/almalinux/kernel-rt","source":"ALSA-2026:49851"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.rt7.492.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-rt-core","purl":"pkg:rpm/almalinux/kernel-rt-core","source":"ALSA-2026:49851"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.rt7.492.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-rt-debug","purl":"pkg:rpm/almalinux/kernel-rt-debug","source":"ALSA-2026:49851"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.rt7.492.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-rt-debug-core","purl":"pkg:rpm/almalinux/kernel-rt-debug-core","source":"ALSA-2026:49851"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.rt7.492.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-rt-debug-devel","purl":"pkg:rpm/almalinux/kernel-rt-debug-devel","source":"ALSA-2026:49851"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.rt7.492.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-rt-debug-modules","purl":"pkg:rpm/almalinux/kernel-rt-debug-modules","source":"ALSA-2026:49851"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.rt7.492.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-rt-debug-modules-extra","purl":"pkg:rpm/almalinux/kernel-rt-debug-modules-extra","source":"ALSA-2026:49851"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.rt7.492.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-rt-devel","purl":"pkg:rpm/almalinux/kernel-rt-devel","source":"ALSA-2026:49851"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.rt7.492.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-rt-modules","purl":"pkg:rpm/almalinux/kernel-rt-modules","source":"ALSA-2026:49851"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.rt7.492.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-rt-modules-extra","purl":"pkg:rpm/almalinux/kernel-rt-modules-extra","source":"ALSA-2026:49851"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-tools","purl":"pkg:rpm/almalinux/kernel-tools","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-tools-libs","purl":"pkg:rpm/almalinux/kernel-tools-libs","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-tools-libs-devel","purl":"pkg:rpm/almalinux/kernel-tools-libs-devel","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-zfcpdump","purl":"pkg:rpm/almalinux/kernel-zfcpdump","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-zfcpdump-core","purl":"pkg:rpm/almalinux/kernel-zfcpdump-core","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-zfcpdump-devel","purl":"pkg:rpm/almalinux/kernel-zfcpdump-devel","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-zfcpdump-modules","purl":"pkg:rpm/almalinux/kernel-zfcpdump-modules","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-zfcpdump-modules-extra","purl":"pkg:rpm/almalinux/kernel-zfcpdump-modules-extra","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"perf","purl":"pkg:rpm/almalinux/perf","source":"ALSA-2026:49857"},{"ecosystem":"AlmaLinux:8","fixed":["4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"python3-perf","purl":"pkg:rpm/almalinux/python3-perf","source":"ALSA-2026:49857"},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","fixed":["0:4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"bpftool","purl":"pkg:rpm/redhat/bpftool","source":"RHSA-2026:49857"},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","fixed":["0:4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"bpftool-debuginfo","purl":"pkg:rpm/redhat/bpftool-debuginfo","source":"RHSA-2026:49857"},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","fixed":["0:4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel","purl":"pkg:rpm/redhat/kernel","source":"RHSA-2026:49857"},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","fixed":["0:4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-abi-stablelists","purl":"pkg:rpm/redhat/kernel-abi-stablelists","source":"RHSA-2026:49857"},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","fixed":["0:4.18.0-553.151.1.el8_10"],"introduced":["0"],"last_affected":[],"package":"kernel-core","purl":"pkg:rpm/redhat/kernel-core","source":"RHSA-2026:49857"}],"prev":{"headline":"batman-adv: dat: handle forward allocation error","id":"CVE-2026-52922"},"products":["Linux"],"published":"2026-06-24","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"MIT","name":"AlmaLinux","prefix":"ALSA"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A Linux kernel IPC bug allows attackers to trigger a use-after-free via checkpoint/restore, potentially leading to code execution or system crashes.","url":"https://insights.sbomify.com/CVE-2026-52923/"}