PT-2026-51723 · Linux · Linux

Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-52930

NVD

In the Linux kernel, the following vulnerability has been resolved:

ipc/shm: serialize orphan cleanup with shm nattch updates

shm destroy orphaned() walks the shm idr under shm ids(ns).rwsem, but that does not serialize all fields tested by shm may destroy(). In particular, shm nattch is updated while holding shm perm.lock, and attach paths can do that without holding the rwsem.

Do not decide that an orphaned segment is unused before taking the object lock. Move the shm may destroy() check under shm perm.lock, matching the other destroy paths, and unlock the segment when it no longer qualifies for removal.

Identificadores relacionados

CVE-2026-52930

Produtos afetados

Linux

Referências · 9

• https://git.kernel.org/stable/c/1f0d01e35dbb228084d5187212e32c91a30dcbeb · Nota
• https://git.kernel.org/stable/c/b1e9aef48e4d8a0c1b54fb913077b0824ed7d650 · Nota
• https://git.kernel.org/stable/c/92cda2593cf2ed25b0e9d78e5e6d8303bba1a064 · Nota
• https://git.kernel.org/stable/c/db752ebfdaf2c7f27cd9690ef48b616af068319c · Nota
• https://git.kernel.org/stable/c/030bbc857bd51d4b25a90d931d3f8775ef22823a · Nota
• https://git.kernel.org/stable/c/2e5c6f4fd4001562781e99bbfc7f1f0127187542 · Nota
• https://git.kernel.org/stable/c/6560be3f6a5bb84f006f184f0c966747bb58e1a3 · Nota
• https://git.kernel.org/stable/c/b5107b4ce3ad45fcf369ee2058c8910620f4b5a8 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-52930 · Nota de Segurança