Security readout for executives and security teams
Plain-English summary
A flaw in the Linux kernel’s TIPC networking code can cause the kernel to free the same memory twice while processing a message. The supplied CVSS assessment is 9.8 because network-triggered exploitation is assessed as requiring no privileges or user interaction, with potentially severe confidentiality, integrity, and availability impact.
Executive priority
Prioritize rapid exposure assessment and vendor-supported kernel updates, especially for network-reachable systems using TIPC. The technical severity is critical, but the bundle does not establish active exploitation. Urgency should therefore combine the 9.8 rating with confirmed TIPC use, reachability, system criticality, and distribution-specific patch availability.
Technical view
tipc_msg_validate() may replace and free an skb. tipc_buf_append() retained a copied pointer to the original skb and could free that stale pointer after validation failed, causing a double-free. The kernel fix updates the caller’s head pointer when validation creates a new reassembled skb, ensuring later cleanup targets the correct allocation.
Likely exposure
Exposure is limited to systems running affected Linux kernels where the vulnerable TIPC path is present and reachable. The bundle lists affected releases from 4.15 through 7.1, including several stable-series versions, but does not provide complete distribution-specific package boundaries. Confirm status against the system vendor’s advisory.
Exploitation context
The supplied CVSS vector describes a network-accessible, low-complexity condition requiring neither privileges nor user interaction. However, the source bundle marks this CVE as absent from KEV and provides no evidence of active exploitation, a public proof of concept, or demonstrated code execution. Treat the impact rating as potential, not confirmed exploitation outcome.
Researcher notes
The failure requires skb reallocation during validation followed by validation failure, leaving cleanup with an already-freed original pointer. CWE-763 and the commit description support the double-free classification. The bundle does not establish practical exploitability, affected configuration prerequisites, reliable indicators of compromise, or exact fixed package versions across distributions.
Mitigation direction
- Install a vendor-supported kernel containing the applicable upstream stable fix.
- Apply the relevant Red Hat security errata when using affected Red Hat products.
- Reboot into the updated kernel after installation; installing packages alone may leave the vulnerable kernel running.
- If patching is delayed, obtain vendor-approved interim controls; none are named in the supplied sources.
Validation and detection
- Record each system’s running kernel version, not only its installed package versions.
- Determine whether TIPC is present, enabled, and reachable on each potentially affected system.
- Compare kernel packages against distribution advisories and the cited upstream stable fixes.
- After remediation, verify systems booted into the corrected kernel.
- Review kernel crash records for TIPC-associated memory faults without treating their absence as proof of safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-763: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-52993 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Reported to Red Hat.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-06-24T00:00:00.000Z: Reported to Red Hat.
- 2026-06-24T00:00:00.000Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a438975a6dcdbd70865978c021650d1485586f0bCVE reference, Linux
- https://git.kernel.org/stable/c/4ee4deadaae7cb2e3d53af0fc889cf92a73413c0CVE reference, Linux
- https://git.kernel.org/stable/c/d3556656c6daebf8def751c7e71d11dd0a180d24CVE reference, Linux
- https://git.kernel.org/stable/c/0274f24485fc38032d4093e463dc3ff5c7a667c9CVE reference, Linux
- https://git.kernel.org/stable/c/4d104882bc815d4ec666ace9155f5f52715879a6CVE reference, Linux
- https://git.kernel.org/stable/c/1d5e589055880fae229e229e1929e087dbe08cf3CVE reference, Linux
- https://git.kernel.org/stable/c/29940fff14110ca48c5ccc168d121665b51bb778CVE reference, Linux
- https://git.kernel.org/stable/c/d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3aCVE reference, Linux
- https://access.redhat.com/security/cve/CVE-2026-52993CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2492437CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52993.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:47017CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:45115CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:45116CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Release of Invalid Pointer or Reference
Release of Invalid Pointer or Reference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.