CVE-2026-52923 - Vulnerability Details

- ipc: limit next_id allocation to the valid ID range

Description

In the Linux kernel, the following vulnerability has been resolved:

ipc: limit next_id allocation to the valid ID range

The checkpoint/restore sysctl path can request the next SysV IPC id
through ids->next_id. ipc_idr_alloc() currently forwards that request to
idr_alloc() with an open-ended upper bound.

If the valid tail of the SysV IPC id space is full, the allocation can
spill beyond ipc_mni. The returned SysV IPC id still uses the normal
index encoding, so later lookup and removal can target the wrong slot.
This leaves the real IDR entry behind and breaks the IDR state for the
object.

The bug is in ipc_idr_alloc() in the checkpoint/restore path.

1. ids->next_id is passed to:

idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...)

2. The zero upper bound makes the allocation effectively open-ended.
Once the valid SysV IPC tail is occupied, idr_alloc() can spill past
ipc_mni and allocate an entry beyond the valid IPC id range.

3. The new object id is still encoded with the narrower SysV IPC index
width:

new->id = (new->seq << ipcmni_seq_shift()) + idx

4. Later removal goes through ipc_rmid(), which uses:

ipcid_to_idx(ipcp->id)

That truncates the real IDR index. An object actually stored at a
high index can then be removed as if it lived at a low in-range
index.

5. For shared memory, shm_destroy() frees the current object anyway, but
the real high IDR slot is left behind as a dangling pointer.

6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry
and dereferences freed memory.

Prevent this by bounding the requested allocation to ipc_mni so the
checkpoint/restore path fails once the valid range is exhausted.

Published: 2026-06-24

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`03f595668017f1a1fb971c02fc37140bc6e7bb1c`	affected	< 3bbe2bb9111ce6967a951bfac79af142d816fae5
`03f595668017f1a1fb971c02fc37140bc6e7bb1c`	affected	< 8c58a92849175f5e2ab7bc2734b3b89afe79f6ef
`03f595668017f1a1fb971c02fc37140bc6e7bb1c`	affected	< af24e202b543ded8a34f1d5d3db54eb916173f04
`03f595668017f1a1fb971c02fc37140bc6e7bb1c`	affected	< 157ce2c6836ce0ff19108a819f38df061345425f
`03f595668017f1a1fb971c02fc37140bc6e7bb1c`	affected	< 41058d4c3f63ab64901560a704882e0565f4e456
`03f595668017f1a1fb971c02fc37140bc6e7bb1c`	affected	< a3cc795129e5ec0f8948653a3bf471e7d8852f5e
`03f595668017f1a1fb971c02fc37140bc6e7bb1c`	affected	< bd4be70669af55b974860d13680348cfdf50bbed
`03f595668017f1a1fb971c02fc37140bc6e7bb1c`	affected	< fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139

Linux

affected

Version	Status	Constraints
`3.8`	affected	—
`0`	unaffected	< 3.8
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[03f595668017f1a1fb971c02fc37140bc6e7bb1c,3bbe2bb9111ce6967a951bfac79af142d816fae5)`	affected	code_commit	—
`[03f595668017f1a1fb971c02fc37140bc6e7bb1c,8c58a92849175f5e2ab7bc2734b3b89afe79f6ef)`	affected	code_commit	—
`[03f595668017f1a1fb971c02fc37140bc6e7bb1c,af24e202b543ded8a34f1d5d3db54eb916173f04)`	affected	code_commit	—
`[03f595668017f1a1fb971c02fc37140bc6e7bb1c,157ce2c6836ce0ff19108a819f38df061345425f)`	affected	code_commit	—
`[03f595668017f1a1fb971c02fc37140bc6e7bb1c,41058d4c3f63ab649015a704882e0565f4e456)`	affected	code_commit	—
`[03f595668017f1a1fb971c02fc37140bc6e7bb1c,a3cc795129e5ec0f8948653a3bf471e7d8852f5e)`	affected	code_commit	—
`[03f595668017f1a1fb971c02fc37140bc6e7bb1c,bd4be70669af55b974860d13680348cfdf50bbed)`	affected	code_commit	—
`[03f595668017f1a1fb971c02fc37140bc6e7bb1c,fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.8`	affected	generic	—
`[0,3.8)`	unaffected	generic	—
`[5.10.259,5.11.0)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.93,6.13.0)`	unaffected	semver	—
`[6.18.35,6.19.0)`	unaffected	semver	—
`[7.0.12,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00123.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/157ce2c6836ce0ff19108a819f38df061345425f
https://git.kernel.org/stable/c/3bbe2bb9111ce6967a951bfac79af142d816fae5
https://git.kernel.org/stable/c/41058d4c3f63ab64901560a704882e0565f4e456
https://git.kernel.org/stable/c/8c58a92849175f5e2ab7bc2734b3b89afe79f6ef
https://git.kernel.org/stable/c/a3cc795129e5ec0f8948653a3bf471e7d8852f5e
https://git.kernel.org/stable/c/af24e202b543ded8a34f1d5d3db54eb916173f04
https://git.kernel.org/stable/c/bd4be70669af55b974860d13680348cfdf50bbed
https://git.kernel.org/stable/c/fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139
https://lore.kernel.org/linux-cve-announce/2026062431-CVE-2026-52923-35fb@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-52923
https://www.cve.org/CVERecord?id=CVE-2026-52923

History

Sun, 28 Jun 2026 08:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 25 Jun 2026 03:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Thu, 25 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026062431-CVE-2026-52923-35fb@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-52923 https://www.cve.org/CVERecord?id=CVE-2026-52923
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Wed, 24 Jun 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Wed, 24 Jun 2026 07:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipc: limit next_id allocation to the valid ID range The checkpoint/restore sysctl path can request the next SysV IPC id through ids->next_id. ipc_idr_alloc() currently forwards that request to idr_alloc() with an open-ended upper bound. If the valid tail of the SysV IPC id space is full, the allocation can spill beyond ipc_mni. The returned SysV IPC id still uses the normal index encoding, so later lookup and removal can target the wrong slot. This leaves the real IDR entry behind and breaks the IDR state for the object. The bug is in ipc_idr_alloc() in the checkpoint/restore path. 1. ids->next_id is passed to: idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...) 2. The zero upper bound makes the allocation effectively open-ended. Once the valid SysV IPC tail is occupied, idr_alloc() can spill past ipc_mni and allocate an entry beyond the valid IPC id range. 3. The new object id is still encoded with the narrower SysV IPC index width: new->id = (new->seq << ipcmni_seq_shift()) + idx 4. Later removal goes through ipc_rmid(), which uses: ipcid_to_idx(ipcp->id) That truncates the real IDR index. An object actually stored at a high index can then be removed as if it lived at a low in-range index. 5. For shared memory, shm_destroy() frees the current object anyway, but the real high IDR slot is left behind as a dangling pointer. 6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry and dereferences freed memory. Prevent this by bounding the requested allocation to ipc_mni so the checkpoint/restore path fails once the valid range is exhausted.
Title		ipc: limit next_id allocation to the valid ID range
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/157ce2c6836ce0ff19108a819f38df061345425f https://git.kernel.org/stable/c/3bbe2bb9111ce6967a951bfac79af142d816fae5 https://git.kernel.org/stable/c/41058d4c3f63ab64901560a704882e0565f4e456 https://git.kernel.org/stable/c/8c58a92849175f5e2ab7bc2734b3b89afe79f6ef https://git.kernel.org/stable/c/a3cc795129e5ec0f8948653a3bf471e7d8852f5e https://git.kernel.org/stable/c/af24e202b543ded8a34f1d5d3db54eb916173f04 https://git.kernel.org/stable/c/bd4be70669af55b974860d13680348cfdf50bbed https://git.kernel.org/stable/c/fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-24T07:14:17.849Z

Updated: 2026-06-30T12:09:46.761Z

Reserved: 2026-06-09T07:44:35.367Z

Link: CVE-2026-52923

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Important

Publid Date: 2026-06-24T00:00:00Z

Links: CVE-2026-52923 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-28T14:00:21Z

Weaknesses

CWE-825

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object