CVE-2026-52993: Linux kernel TIPC double-free in tipc_buf_append()
CVE-2026-52993 is a double-free (CWE-415) in the TIPC networking code of the Linux kernel, in tipc_buf_append(). The CNA rates it 9.8 (CVSS 3.1), and the record also lists a 7.0 score from another provider. The record lists affected kernel version ranges and stable-kernel fixes, and it does not list the CVE in CISA KEV.
Overview
CVE-2026-52993 affects the TIPC networking code in the Linux kernel. According to the record, tipc_buf_append() could free a socket buffer (skb) that had already been released during message validation, which is a double-free classified as CWE-415. The record describes the fix as reassigning the buffer pointer when validation reallocates the reassembled skb.
Impact
The CNA scores the issue 9.8 under CVSS 3.1 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network reachability, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. A second provider in the record scores it 7.0 under CVSS 3.1. Real exposure depends on whether the affected TIPC code path is reachable on a given system, and the record does not describe that condition.
Affected products and versions
The record lists the Linux Linux Kernel product with these affected ranges:
- 4.15 up to but not including 5.10.258
- 5.11 up to but not including 5.15.209
- 5.16 up to but not including 6.1.175
- 6.2 up to but not including 6.6.141
- 6.7 up to but not including 6.12.91
- 6.13 up to but not including 6.18.33
- 6.19 up to but not including 7.0.10
The record does not state fixed versions as separate entries. The upper bounds of these ranges are where the listed stable-kernel fixes apply, which is an inference from the data. Administrators should confirm the fixed build for their own distribution, because vendor kernels may backport the change differently.
Exploitation status
The record shows that the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and no EPSS score is available. No confirmed exploitation appears in the sources consulted for this analysis.
Remediation and mitigation
- Update to a stable kernel build that includes the upstream fix, referenced in the Linux stable commit d293ca71 and related commits listed in the record.
- Track distribution errata. Red Hat has published errata that reference this CVE, for example RHSA-2026:47017.
- Where TIPC is not required by the environment, reducing exposure by disabling the module is a reasonable defense-in-depth step. This is general guidance and is not stated in the record.
Detection guidance
- Inventory kernel versions and compare them with the affected ranges above.
- Review systems for kernel memory-corruption messages, such as slab or KASAN reports, which may indicate buffer lifecycle problems. Their absence does not prove that a system is safe.
- Confirm whether TIPC is loaded or in use on hosts, since that determines whether the vulnerable code is relevant.
Limitations of the available information
The record does not include a complete exploitability analysis, a proof of concept, or details of how the flaw is triggered in production. It does not name the second provider of the 7.0 score. The record title is null, so the portal title was written from the description. The source status is Modified, so the details may change. EPSS and SSVC data are not available.
Frequently asked questions
What is CVE-2026-52993?
It is a double-free (CWE-415) in the TIPC networking code of the Linux kernel, in the tipc_buf_append() function. The record says a buffer reallocated during validation could be freed twice.
Is this CVE being actively exploited?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted for this analysis.
How do I fix it?
Update to a stable Linux kernel build that includes the upstream fix for your branch, and follow your distribution's errata. Confirm the fixed build with your vendor, since backports may differ.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.