CVE-2026-52947 - Vulnerability Details

Vendors	Products
Linux	Linux Kernel

Vendors	Products
Linux	Linux Kernel

Link	Providers
https://git.kernel.org/stable/c/03bfa95e452e2b6ccd76a332060ae4feaf5ad84d
https://git.kernel.org/stable/c/2047c2aa0963bb2872fd722300a15bcb441a4c00
https://git.kernel.org/stable/c/2aa4c12723fe432e623462a3be42a197a128722b
https://git.kernel.org/stable/c/3b20ec8f31e8a6a6782243f473b0abd3463621df
https://git.kernel.org/stable/c/474293d90880622fde9d2430fb0165767090f7b3
https://git.kernel.org/stable/c/7de2d447072be3b1a76793f034432338fc9c494b
https://git.kernel.org/stable/c/a2171131ecda1ed61a594a1eb715e75fdad0fef5
https://git.kernel.org/stable/c/ab269990ed58143a92a263be1bee626d82ac03da

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-367

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove In qrtr_port_remove(), the socket reference count is decremented via __sock_put() before the port is removed from the qrtr_ports XArray and before the RCU grace period elapses. This breaks the fundamental RCU update paradigm. It exposes a race window where a concurrent RCU reader (such as qrtr_reset_ports() or qrtr_port_lookup()) can obtain a pointer to the socket from the XArray, and attempt to call sock_hold() on a socket whose reference count has already dropped to zero. This exact race condition was hit during syzkaller fuzzing, leading to the following refcount saturation warning and a potential Use-After-Free: refcount_t: saturated; leaking memory. WARNING: CPU: 3 PID: 1273 at lib/refcount.c:22 refcount_warn_saturate+0xae/0x1d0 Modules linked in: qrtr(+) bochs drm_shmem_helper ... Call Trace: <TASK> qrtr_reset_ports net/qrtr/af_qrtr.c:768 [inline] [qrtr] __qrtr_bind.isra.0+0x48b/0x570 net/qrtr/af_qrtr.c:805 [qrtr] qrtr_bind+0x17d/0x210 net/qrtr/af_qrtr.c:901 [qrtr] kernel_bind+0xe4/0x120 net/socket.c:3592 qrtr_ns_init+0x1a6/0x380 net/qrtr/ns.c:715 [qrtr] qrtr_proto_init+0x3b/0xff0 net/qrtr/af_qrtr.c:169 [qrtr] do_one_initcall+0xf5/0x5e0 init/main.c:1283 ... </TASK> Fix this by deferring the reference count decrement until after the xa_erase() and the synchronize_rcu() complete. (Note: The v1 of this patch incorrectly replaced __sock_put() with sock_put(). As Simon Horman pointed out, the callers of qrtr_port_remove() still hold a reference to the socket, so freeing the socket memory here would lead to a subsequent UAF in the caller. Thus, the __sock_put() is kept, but only repositioned to close the RCU race.)
Title		net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/03bfa95e452e2b6ccd76a332060ae4feaf5ad84d https://git.kernel.org/stable/c/2047c2aa0963bb2872fd722300a15bcb441a4c00 https://git.kernel.org/stable/c/2aa4c12723fe432e623462a3be42a197a128722b https://git.kernel.org/stable/c/3b20ec8f31e8a6a6782243f473b0abd3463621df https://git.kernel.org/stable/c/474293d90880622fde9d2430fb0165767090f7b3 https://git.kernel.org/stable/c/7de2d447072be3b1a76793f034432338fc9c494b https://git.kernel.org/stable/c/a2171131ecda1ed61a594a1eb715e75fdad0fef5 https://git.kernel.org/stable/c/ab269990ed58143a92a263be1bee626d82ac03da

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-52947", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.371Z", "datePublished": "2026-06-24T16:26:05.062Z", "dateUpdated": "2026-06-24T16:26:05.062Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-24T16:26:05.062Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove\n\nIn qrtr_port_remove(), the socket reference count is decremented via\n__sock_put() before the port is removed from the qrtr_ports XArray and\nbefore the RCU grace period elapses.\n\nThis breaks the fundamental RCU update paradigm. It exposes a race\nwindow where a concurrent RCU reader (such as qrtr_reset_ports() or\nqrtr_port_lookup()) can obtain a pointer to the socket from the XArray,\nand attempt to call sock_hold() on a socket whose reference count has\nalready dropped to zero.\n\nThis exact race condition was hit during syzkaller fuzzing, leading to\nthe following refcount saturation warning and a potential Use-After-Free:\n\n refcount_t: saturated; leaking memory.\n WARNING: CPU: 3 PID: 1273 at lib/refcount.c:22 refcount_warn_saturate+0xae/0x1d0\n Modules linked in: qrtr(+) bochs drm_shmem_helper ...\n Call Trace:\n <TASK>\n qrtr_reset_ports net/qrtr/af_qrtr.c:768 [inline] [qrtr]\n __qrtr_bind.isra.0+0x48b/0x570 net/qrtr/af_qrtr.c:805 [qrtr]\n qrtr_bind+0x17d/0x210 net/qrtr/af_qrtr.c:901 [qrtr]\n kernel_bind+0xe4/0x120 net/socket.c:3592\n qrtr_ns_init+0x1a6/0x380 net/qrtr/ns.c:715 [qrtr]\n qrtr_proto_init+0x3b/0xff0 net/qrtr/af_qrtr.c:169 [qrtr]\n do_one_initcall+0xf5/0x5e0 init/main.c:1283\n ...\n </TASK>\n\nFix this by deferring the reference count decrement until after the\nxa_erase() and the synchronize_rcu() complete.\n\n(Note: The v1 of this patch incorrectly replaced __sock_put() with\nsock_put(). As Simon Horman pointed out, the callers of qrtr_port_remove()\nstill hold a reference to the socket, so freeing the socket memory here\nwould lead to a subsequent UAF in the caller. Thus, the __sock_put() is\nkept, but only repositioned to close the RCU race.)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/qrtr/af_qrtr.c"], "versions": [{"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881", "lessThan": "2aa4c12723fe432e623462a3be42a197a128722b", "status": "affected", "versionType": "git"}, {"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881", "lessThan": "03bfa95e452e2b6ccd76a332060ae4feaf5ad84d", "status": "affected", "versionType": "git"}, {"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881", "lessThan": "474293d90880622fde9d2430fb0165767090f7b3", "status": "affected", "versionType": "git"}, {"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881", "lessThan": "2047c2aa0963bb2872fd722300a15bcb441a4c00", "status": "affected", "versionType": "git"}, {"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881", "lessThan": "7de2d447072be3b1a76793f034432338fc9c494b", "status": "affected", "versionType": "git"}, {"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881", "lessThan": "ab269990ed58143a92a263be1bee626d82ac03da", "status": "affected", "versionType": "git"}, {"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881", "lessThan": "3b20ec8f31e8a6a6782243f473b0abd3463621df", "status": "affected", "versionType": "git"}, {"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881", "lessThan": "a2171131ecda1ed61a594a1eb715e75fdad0fef5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/qrtr/af_qrtr.c"], "versions": [{"version": "4.7", "status": "affected"}, {"version": "0", "lessThan": "4.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.94", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.36", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.13", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "5.10.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.12.94"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.18.36"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.0.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2aa4c12723fe432e623462a3be42a197a128722b"}, {"url": "https://git.kernel.org/stable/c/03bfa95e452e2b6ccd76a332060ae4feaf5ad84d"}, {"url": "https://git.kernel.org/stable/c/474293d90880622fde9d2430fb0165767090f7b3"}, {"url": "https://git.kernel.org/stable/c/2047c2aa0963bb2872fd722300a15bcb441a4c00"}, {"url": "https://git.kernel.org/stable/c/7de2d447072be3b1a76793f034432338fc9c494b"}, {"url": "https://git.kernel.org/stable/c/ab269990ed58143a92a263be1bee626d82ac03da"}, {"url": "https://git.kernel.org/stable/c/3b20ec8f31e8a6a6782243f473b0abd3463621df"}, {"url": "https://git.kernel.org/stable/c/a2171131ecda1ed61a594a1eb715e75fdad0fef5"}], "title": "net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove", "x_generator": {"engine": "bippy-1.2.0"}}}}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bdabad3e363d825ddf9679dd431cca0b2c30f881,2aa4c12723fe432e623462a3be42a197a128722b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bdabad3e363d825ddf9679dd431cca0b2c30f881,03bfa95e452e2b6ccd76a332060ae4feaf5ad84d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bdabad3e363d825ddf9679dd431cca0b2c30f881,474293d90880622fde9d2430fb0165767090f7b3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bdabad3e363d825ddf9679dd431cca0b2c30f881,2047c2aa0963bb2872fd722300a15bcb441a4c00)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bdabad3e363d825ddf9679dd431cca0b2c30f881,7de2d447072be3b1a76793f034432338fc9c494b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bdabad3e363d825ddf9679dd431cca0b2c30f881,ab269990ed58143a92a263be1bee626d82ac03da)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bdabad3e363d825ddf9679dd431cca0b2c30f881,3b20ec8f31e8a6a6782243f473b0abd3463621df)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bdabad3e363d825ddf9679dd431cca0b2c30f881,a2171131ecda1ed61a594a1eb715e75fdad0fef5)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.259,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.210,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.176,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.143,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.94,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.36,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.13,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-24T19:15:15.571789+00:00", "updated": "2026-06-24T20:40:38.357038+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-367", "CWE-362"]}

Metrics

Affected Vendors & Products

Metrics

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object

JSON object