CVE-2026-52993

The tipc_msg_validate() function may reallocate the skb (socket buffer) pointer, freeing the original buffer. In tipc_buf_append(), the pointer passed to this function was a local copy of the caller's skb pointer, not the original pointer. If validation failed after reallocation, the error handling path freed the original skb pointer again — even though it was already freed during reallocation. The fix consists of checking whether the head pointer points to a newly allocated buffer of the reassembled skb, and in such case reassigning *headbuf for subsequent memory release operations.

An attacker can cause heap corruption through double-free, which consequently may result in arbitrary code execution in kernel context (RCE), privilege escalation, or system failure (kernel panic / DoS).

Apply patches available from the vendor according to references — fixes have been published in the Linux kernel stable repository (including commits: 0274f24485fc, 1d5e589055880f, 29940fff14110c, 4d104882bc815d, 4ee4deadaae7cb). It is recommended to update to the latest stable kernel version containing the described fix. If immediate update is not possible, consider disabling the TIPC subsystem in the kernel, if it is not required.

Linux kernel with active TIPC subsystem; specific versions indicated in vendor references (commits available in stable.kernel.org repository).