CVE-2026-52993: tipc: fix double-free in tipc_buf_append()

Synopsis

A double-free vulnerability exists in the Linux kernel's TIPC (Transparent Inter-Process Communication) networking subsystem, specifically in the tipc_buf_append() function. The flaw is reachable over the network without any authentication or user interaction, because a remote attacker can send crafted TIPC packets that trigger a skb (socket buffer) reallocation and a subsequent invalid free of an already-freed pointer. Successful exploitation gives the attacker full read, write, and crash capabilities against the affected host. A patched-image rebuild is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the TIPC service over the network; no local access or physical presence is needed.

• AuthenticationNot required

  No credentials or session token of any kind are required; the exploit is available to any remote sender.

• Victim interactionNot required

  No user on the target system needs to open a file, click a link, or take any other action for exploitation to succeed.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and requires no special timing, race conditions, or knowledge of memory layout beyond sending crafted TIPC packets.

Blast Radius

• A successful attacker can read arbitrary kernel memory, exposing cryptographic keys, session tokens, and other sensitive data held in kernel space.
• The attacker can write to arbitrary kernel memory, allowing modification of security-critical kernel structures or persisted data paths.
• Exploiting the double-free can crash the affected host entirely, causing a full denial of service for all workloads running on that node.
• Kernel memory corruption from the double-free creates a practical path to full privilege escalation and arbitrary code execution at the kernel level.