PT-2026-51758 · Linux · Linux Kernel

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-52943

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the network skbuff component where the pskb carve inside header() and pskb carve inside nonlinear() functions copy the skb shared info header into a new buffer without calling net zcopy get() for the new shared information. This results in an unaccounted holder for the destructor arg pointer used in MSG ZEROCOPY skbs. Consequently, the reference count of uarg can be driven to zero prematurely, leading to a use-after-free condition on ubuf info msgzc while TX skbs still hold live pointers. This flaw allows an unprivileged local user to achieve full root privilege escalation on a default kernel configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-52943

Affected Products

Linux Kernel

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-52943 · Security Note
• https://git.kernel.org/stable/c/fd470f0a97b8e9a125f520265d2f3b088ffb5b8a · Note
• https://git.kernel.org/stable/c/96a4713ae041cc85e712bac682cd2e644004d6c6 · Note
• https://twitter.com/infoflowcloud/status/2069746270520963123 · Twitter Post
• https://git.kernel.org/stable/c/474d6c771d798bca84f0a140b611e36743511e18 · Note
• https://git.kernel.org/stable/c/9b40bdc2a3298225dffab8158208a0d8c6300578 · Note
• https://git.kernel.org/stable/c/8dbed691e43a50903658130bde0fcb5abc425b37 · Note
• https://git.kernel.org/stable/c/ceafb893b12f23331dcc5ff9587e643c3a40ee9f · Note
• https://twitter.com/CVEnew/status/2069745497959518488 · Twitter Post
• https://git.kernel.org/stable/c/2e0e74c59b2761a414d9f48d7bee1e45220b2427 · Note
• https://git.kernel.org/stable/c/98d0912e9f841e5529a5b89a972805f34cb1c69d · Note