CVE-2026-52943

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zerocopy reference in pskb_carve helpers pskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy the old skb_shared_info header into a new buffer via memcpy(), which includes the destructor_arg pointer (uarg) for MSG_ZEROCOPY skbs. Neither function calls net_zcopy_get() for the new shinfo, creating an unaccounted holder: every skb_shared_info with destructor_arg set will call skb_zcopy_clear() once when freed, but the corresponding net_zcopy_get() was never called for the new copy. Re...

Affected product and versions

Product

Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6

Affected versions

>= 6fa01ccd883021105e9f8af7d04b9f156fa3494a < 8dbed691e43a50903658130bde0fcb5abc425b37, >= 6fa01ccd883021105e9f8af7d04b9f156fa3494a < 9b40bdc2a3298225dffab8158208a0d8c6300578, >= 6fa01ccd883021105e9f8af7d04b9f156fa3494a < fd470f0a97b8e9a125f520265d2f3b088ffb5b8a, >= 6fa01ccd883021105e9f8af7d04b9f156fa3494a < ceafb893b12f23331dcc5ff9587e643c3a40ee9f, >= 6fa01ccd883021105e9f8af7d04b9f156fa3494a < 2e0e74c59b2761a414d9f48d7bee1e45220b2427, >= 6fa01ccd883021105e9f8af7d04b9f156fa3494a < 96a4713ae041cc85e712bac682cd2e644004d6c6, >= 6fa01ccd883021105e9f8af7d04b9f156fa3494a < 474d6c771d798bca84f0a140b611e36743511e18, >= 6fa01ccd883021105e9f8af7d04b9f156fa3494a < 98d0912e9f841e5529a5b89a972805f34cb1c69d, >= 4.7, >= 4.7 < 5.10.259, >= 5.11 < 5.15.210, >= 5.16 < 6.1.176, >= 6.2 < 6.6.143, >= 6.7 < 6.12.93, >= 6.13 < 6.18.35, >= 6.19 < 7.0.12, 7.1

Fixed versions

5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416, CWE-911