CVE-2026-52923

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free flaw exists in the ipc idr alloc() function within the checkpoint/restore path for SysV Inter-Process Communication (IPC) ID allocation. The function forwards requests to idr alloc() with an open-ended upper bound. When the valid SysV IPC ID space is full, allocations can exceed ipc mni, resulting in IDs that use normal index encoding but target incorrect slots during lookup and removal. This breaks the IDR state and can leave a dangling pointer in the IDR entry. Specifically, for shared memory, the shm destroy() function may free an object while leaving a stale entry that, when accessed via /proc/sysvipc/shm, leads to a dereference of freed memory. This issue can be exploited by local attackers to achieve local privilege escalation to root.

Technical details include:

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.