CVE-2026-52947

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove In qrtr_port_remove(), the socket reference count is decremented via __sock_put() before the port is removed from the qrtr_ports XArray and before the RCU grace period elapses. This breaks the fundamental RCU update paradigm. It exposes a race window where a concurrent RCU reader (such as qrtr_reset_ports() or qrtr_port_lookup()) can obtain a pointer to the socket from the XArray, and attempt to call sock_hold() on a socket whose reference count has al...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= bdabad3e363d825ddf9679dd431cca0b2c30f881 < 2aa4c12723fe432e623462a3be42a197a128722b, >= bdabad3e363d825ddf9679dd431cca0b2c30f881 < 03bfa95e452e2b6ccd76a332060ae4feaf5ad84d, >= bdabad3e363d825ddf9679dd431cca0b2c30f881 < 474293d90880622fde9d2430fb0165767090f7b3, >= bdabad3e363d825ddf9679dd431cca0b2c30f881 < 2047c2aa0963bb2872fd722300a15bcb441a4c00, >= bdabad3e363d825ddf9679dd431cca0b2c30f881 < 7de2d447072be3b1a76793f034432338fc9c494b, >= bdabad3e363d825ddf9679dd431cca0b2c30f881 < ab269990ed58143a92a263be1bee626d82ac03da, >= bdabad3e363d825ddf9679dd431cca0b2c30f881 < 3b20ec8f31e8a6a6782243f473b0abd3463621df, >= bdabad3e363d825ddf9679dd431cca0b2c30f881 < a2171131ecda1ed61a594a1eb715e75fdad0fef5, >= 4.7, >= 4.7 < 5.10.259, >= 5.11 < 5.15.210, >= 5.16 < 6.1.176, >= 6.2 < 6.6.143, >= 6.7 < 6.12.94, >= 6.13 < 6.18.36, >= 6.19 < 7.0.13, 7.1

Fixed versions

5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416