CVE-2026-52943

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the Linux kernel due to a missing zerocopy reference in the pskb carve inside header() and pskb carve inside nonlinear() functions. Both functions copy the skb shared info header into a new buffer using memcpy(), which includes the destructor arg pointer (uarg) for MSG ZEROCOPY skbs. Because these functions fail to call net zcopy get() for the new shinfo, the reference count uarg->refcnt can be driven to zero prematurely. This leads to the premature freeing of ubuf info msgzc while TX skbs still hold active destructor arg pointers. This flaw has been verified to allow an unprivileged local user to achieve full root privilege escalation on a default kernel configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.