CVE-2026-52923: ipc: limit next_id allocation to the valid ID range
Noroxi assessment
Priority: Monitor (action score 31/100)
- Public proof-of-concept code exists (GitHub); there is no record of exploitation in the wild.
- Probability of exploitation in the next 30 days: 0.21% (FIRST EPSS).
- Someone with local access to the system can trigger it. A low-privileged account is enough. No user action is required. No special conditions are required; it is repeatable.
- Fixed version: Linux Linux 157ce2c6836ce0ff19108a819f38df061345425f, 3bbe2bb9111ce6967a951bfac79af142d816fae5, 41058d4c3f63ab64901560a704882e0565f4e456; azl3 kernel 6.6.141.1-1 on Azure Linux 3.0 6.6.143.1-1.
- Mentioned 1 time in Turkish national cyber security advisories (siberguvenlik.gov.tr).
Low priority for now. Upgrade to Linux Linux 157ce2c6836ce0ff19108a819f38df061345425f, 3bbe2bb9111ce6967a951bfac79af142d816fae5, 41058d4c3f63ab64901560a704882e0565f4e456; azl3 kernel 6.6.141.1-1 on Azure Linux 3.0 6.6.143.1-1 or later.
Generated automatically from the record's data: CVSS (NVD and CNA), CISA KEV and SSVC, FIRST EPSS, exploit sources, fixed versions. How we calculate it
Primary sources: NVD · CVE.org · FIRST EPSS
In the Linux kernel, the following vulnerability has been resolved: ipc: limit next_id allocation to the valid ID range The checkpoint/restore sysctl path can request the next SysV IPC id through ids->next_id. ipc_idr_alloc() currently forwards that request to idr_alloc() with an open-ended upper bound. If the valid tail of the SysV IPC id space is full, the allocation can spill beyond ipc_mni. The returned SysV IPC id still uses the normal index encoding, so later lookup and removal can target the wrong slot. This leaves the real IDR entry behind and breaks the IDR state for the object. The bug is in ipc_idr_alloc() in the checkpoint/restore path. 1. ids->next_id is passed to: idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...) 2. The zero upper bound makes the allocation effectively open-ended. Once the valid SysV IPC tail is occupied, idr_alloc() can spill past ipc_mni and allocate an entry beyond the valid IPC id range. 3. The new object id is still encoded with the narrower SysV IPC index width: new->id = (new->seq << ipcmni_seq_shift()) + idx 4. Later removal goes through ipc_rmid(), which uses: ipcid_to_idx(ipcp->id) That truncates the real IDR index. An object actually stored at a high index can then be removed as if it lived at a low in-range index. 5. For shared memory, shm_destroy() frees the current object anyway, but the real high IDR slot is left behind as a dangling pointer. 6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry and dereferences freed memory. Prevent this by bounding the requested allocation to ipc_mni so the checkpoint/restore path fails once the valid range is exhausted.
- BDU:2026-13716
- ALSA-2026:49212
- ALSA-2026:49851
- ALSA-2026:49857
- ALSA-2026:53330
- RHSA-2026:47248
- RHSA-2026:48386
- RHSA-2026:49031
- RHSA-2026:49212
- RHSA-2026:49851
- RHSA-2026:49857
- RHSA-2026:51603
- RHSA-2026:51604
- RHSA-2026:52649
- RHSA-2026:52764
- RHSA-2026:53330
- RHSA-2026:61692
- RHSA-2026:63189
- RHSA-2026:77216
- RLSA-2026:49212
- Published
- Jun 24, 2026
- Updated
- Oct 19, 2026
- EPSS
- 0.2% · 12th percentile
- CWE
- CWE-401
Report tools
Action score
31
Low priority for now.
- CVSS
- 31 / 40 · 7.8 / 10
- CISA KEV
- 0 / 30 · Not listed
- EPSS
- 0 / 30 · 0.2%
CISA SSVC decision
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
Vulnrichment: CISA's decision-tree inputs.
CNA vs NVD score
- NVD
- —
- CNA · Linux
- 7.8
- NVD has not scored this yet; the score shown is the CNA’s.
The score given by the assigning authority versus NVD’s independent score. A gap means the severity is contested.
Get told when this record changes
- Not in KEV: no record of exploitation in the wild
- Proof of concept exists, no weaponized module
- A fix has been released
If any of these changes, we'll tell you in the daily email digest.
Is your version affected? Check itNoroxi analysis
What does it mean in your environment?
The assessment above is generated automatically from the record's data; it doesn't know your environment. Our team verifies on your systems whether this vulnerability is actually exploitable and which mitigation is enough.
We use this product, ask for helpAffected systems
Is your version affected?
Pick the product and type the version you run. It's compared with this record's version ranges in your browser; the version isn't sent anywhere.
| Vendor | Product | CPE |
|---|---|---|
| linux | linux kernel | cpe:2.3:o:linux:linux_kernel |
Versions reported by the vendor
Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.
Linux Linux
- 3.8affected
- 03f595668017f1a1fb971c02fc37140bc6e7bb1c and later · before 3bbe2bb9111ce6967a951bfac79af142d816fae5affected · git
- 03f595668017f1a1fb971c02fc37140bc6e7bb1c and later · before 8c58a92849175f5e2ab7bc2734b3b89afe79f6efaffected · git
- 03f595668017f1a1fb971c02fc37140bc6e7bb1c and later · before af24e202b543ded8a34f1d5d3db54eb916173f04affected · git
- 03f595668017f1a1fb971c02fc37140bc6e7bb1c and later · before 157ce2c6836ce0ff19108a819f38df061345425faffected · git
- 03f595668017f1a1fb971c02fc37140bc6e7bb1c and later · before 41058d4c3f63ab64901560a704882e0565f4e456affected · git
- 03f595668017f1a1fb971c02fc37140bc6e7bb1c and later · before a3cc795129e5ec0f8948653a3bf471e7d8852f5eaffected · git
- 03f595668017f1a1fb971c02fc37140bc6e7bb1c and later · before bd4be70669af55b974860d13680348cfdf50bbedaffected · git
- 03f595668017f1a1fb971c02fc37140bc6e7bb1c and later · before fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139affected · git
- before 3.8not affected · semver
Affected versions · NVD (9)
NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.
- linux linux kernel3.8.1 and later · before 5.10.259
- linux linux kernel5.11 and later · before 5.15.210
- linux linux kernel5.16 and later · before 6.1.176
- linux linux kernel6.2 and later · before 6.6.143
- linux linux kernel6.7 and later · before 6.12.93
- linux linux kernel6.13 and later · before 6.18.35
- linux linux kernel6.19 and later · before 7.0.12
- linux linux kernel3.8
- linux linux kernel7.1
Package-level exposure
OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.
| Ecosystem | Package | Affected range | Fix |
|---|---|---|---|
| AlmaLinux:10 | kernel | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-64k | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-64k-core | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-64k-debug | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-64k-debug-core | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-64k-debug-devel | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-64k-debug-devel-matched | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-64k-debug-modules | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-64k-debug-modules-core | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-64k-debug-modules-extra | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-64k-devel | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-64k-devel-matched | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-64k-modules | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-64k-modules-core | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-64k-modules-extra | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-abi-stablelists | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-core | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-cross-headers | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-debug | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-debug-core | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-debug-devel | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-debug-devel-matched | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-debug-modules | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
| AlmaLinux:10 | kernel-debug-modules-core | before 6.12.0-211.46.1.el10_2 | 6.12.0-211.46.1.el10_2 |
+96
Same product
linux: all recordsOther highest-scoring records for the same primary product.
- CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV90Now
- CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe…KEV89Now
- CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV85Now
Published before and after this one in the same product
- ← EarlierCVE-2026-52920Jun 24, 2026 · netfilter: xt_policy: fix strict mode inbound policy matching33Monitor
- ← EarlierCVE-2026-52921Jun 24, 2026 · netfilter: ipset: stop hash:* range iteration at end22Monitor
- Later →CVE-2026-52924Jun 24, 2026 · sctp: purge outqueue on stale COOKIE-ECHO handling39Monitor
Remediation
Which version to upgrade to
Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.
| Product / package | Fixed version | Source |
|---|---|---|
| Linux Linux | 157ce2c6836ce0ff19108a819f38df061345425f | Vendor (CNA) |
| Linux Linux | 3bbe2bb9111ce6967a951bfac79af142d816fae5 | Vendor (CNA) |
| Linux Linux | 41058d4c3f63ab64901560a704882e0565f4e456 | Vendor (CNA) |
| Linux Linux | 8c58a92849175f5e2ab7bc2734b3b89afe79f6ef | Vendor (CNA) |
| Linux Linux | a3cc795129e5ec0f8948653a3bf471e7d8852f5e | Vendor (CNA) |
| Linux Linux | af24e202b543ded8a34f1d5d3db54eb916173f04 | Vendor (CNA) |
| Linux Linux | bd4be70669af55b974860d13680348cfdf50bbed | Vendor (CNA) |
| Linux Linux | fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139 | Vendor (CNA) |
| azl3 kernel 6.6.141.1-1 on Azure Linux 3.0 | 6.6.143.1-1 · CBL-Mariner Releases | Microsoft (MSRC) |
| almalinux:kernel | 5.14.0-687.33.1.el9_8 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k | 5.14.0-687.33.1.el9_8 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-core | 5.14.0-687.33.1.el9_8 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-debug | 5.14.0-687.33.1.el9_8 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-debug-core | 5.14.0-687.33.1.el9_8 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-debug-devel | 5.14.0-687.33.1.el9_8 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-debug-devel-matched | 5.14.0-687.33.1.el9_8 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-debug-modules | 5.14.0-687.33.1.el9_8 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-debug-modules-core | 5.14.0-687.33.1.el9_8 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-debug-modules-extra | 5.14.0-687.33.1.el9_8 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-devel | 5.14.0-687.33.1.el9_8 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-devel-matched | 5.14.0-687.33.1.el9_8 · AlmaLinux:9 | Package registry (OSV) |
| debian:linux | 6.1.176-1 · Debian:12 | Package registry (OSV) |
| red hat:bpftool | 0:4.18.0-305.200.1.el8_4 · Red Hat:rhel_aus:8.4::baseos | Package registry (OSV) |
| red hat:bpftool-debuginfo | 0:4.18.0-305.200.1.el8_4 · Red Hat:rhel_aus:8.4::baseos | Package registry (OSV) |
| red hat:kernel | 0:4.18.0-305.200.1.el8_4 · Red Hat:rhel_aus:8.4::baseos | Package registry (OSV) |
| red hat:kernel-abi-stablelists | 0:4.18.0-305.200.1.el8_4 · Red Hat:rhel_aus:8.4::baseos | Package registry (OSV) |
| red hat:kernel-core | 0:4.18.0-305.200.1.el8_4 · Red Hat:rhel_aus:8.4::baseos | Package registry (OSV) |
| red hat:kernel-debug | 0:4.18.0-305.200.1.el8_4 · Red Hat:rhel_aus:8.4::baseos | Package registry (OSV) |
| red hat:kernel-debug-core | 0:4.18.0-305.200.1.el8_4 · Red Hat:rhel_aus:8.4::baseos | Package registry (OSV) |
| red hat:kernel-debug-debuginfo | 0:4.18.0-305.200.1.el8_4 · Red Hat:rhel_aus:8.4::baseos | Package registry (OSV) |
+18
Exploit status
Proof of concept available
A public proof of concept or detection signature exists. Exploit knowledge is out there; don't delay patching.
Evidence
- Proof-of-concept repository on GitHub ×1
Noroxi does not host or link to exploit code. Metasploit module names and Nuclei template ids are shown (names, not code); Exploit-DB entries and PoC repositories are given as counts only.
| Source | Kind | Date |
|---|---|---|
| Proof-of-concept repository on GitHub | stars:0 | 2026-08-28 |
Research context
For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.
Timeline
From publication to today: proof of concept, Metasploit module, CISA KEV and fix record. Dates are as reported by the sources.
- Published
- First PoC+65 d
- TodayNov 13, 2026+142 d
National notice (Türkiye Cybersecurity Directorate / USOM)
Official security notices citing this record; remediation advice is on the agency's page.
- TR-26-0440 · Jun 25, 2026(Linux Kernel Güvenlik Bildirimi)
Not on record for this CVE: EPSS history · patch commit or PR link · researcher credit · variant or chain candidate · public bounty program.
Technical details
Attack conditions
- Someone with local access to the system can trigger it.
- A low-privileged account is enough.
- No user action is required.
- No special conditions are required; it is repeatable.
If successful
- Confidentiality
- high · data can be read
- Integrity
- high · data or configuration can be modified
- Availability
- high · the service can be disrupted
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality impact
- High
- Integrity impact
- High
- Availability impact
- High
Weakness class (CWE)
CWE-401 · Missing Release of Memory after Effective LifetimeCVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd-secondary
Attack context
MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.
MITRE has no CAPEC/ATT&CK mapping for this CWE.
Change log (2)
- SSVC exploitation— → none
- Fix✗ → ✓
For records you follow, these changes also arrive as notifications. →
References
Show all references (19 more)Show less
- git.kernel.org/stable/c/3bbe2bb9111ce6967a951bfac79af142d816fae5
- git.kernel.org/stable/c/41058d4c3f63ab64901560a704882e0565f4e456
- git.kernel.org/stable/c/8c58a92849175f5e2ab7bc2734b3b89afe79f6ef
- git.kernel.org/stable/c/a3cc795129e5ec0f8948653a3bf471e7d8852f5e
- git.kernel.org/stable/c/af24e202b543ded8a34f1d5d3db54eb916173f04
- git.kernel.org/stable/c/bd4be70669af55b974860d13680348cfdf50bbed
- git.kernel.org/stable/c/fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139
- access.redhat.com/errata/RHSA-2026:47248
- access.redhat.com/errata/RHSA-2026:48386
- access.redhat.com/errata/RHSA-2026:49031
- access.redhat.com/errata/RHSA-2026:49212
- access.redhat.com/errata/RHSA-2026:49851
- access.redhat.com/errata/RHSA-2026:49857
- access.redhat.com/errata/RHSA-2026:51603
- access.redhat.com/errata/RHSA-2026:51604
- access.redhat.com/errata/RHSA-2026:52649
- access.redhat.com/errata/RHSA-2026:52764
- access.redhat.com/errata/RHSA-2026:53330
- access.redhat.com/errata/RHSA-2026:61692
Vendor advisories and official records. Exploit/PoC links are deliberately left out.