U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. Vulnerabilities

CVE-2026-52923 Detail

Description

In the Linux kernel, the following vulnerability has been resolved: ipc: limit next_id allocation to the valid ID range The checkpoint/restore sysctl path can request the next SysV IPC id through ids->next_id. ipc_idr_alloc() currently forwards that request to idr_alloc() with an open-ended upper bound. If the valid tail of the SysV IPC id space is full, the allocation can spill beyond ipc_mni. The returned SysV IPC id still uses the normal index encoding, so later lookup and removal can target the wrong slot. This leaves the real IDR entry behind and breaks the IDR state for the object. The bug is in ipc_idr_alloc() in the checkpoint/restore path. 1. ids->next_id is passed to: idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...) 2. The zero upper bound makes the allocation effectively open-ended. Once the valid SysV IPC tail is occupied, idr_alloc() can spill past ipc_mni and allocate an entry beyond the valid IPC id range. 3. The new object id is still encoded with the narrower SysV IPC index width: new->id = (new->seq << ipcmni_seq_shift()) + idx 4. Later removal goes through ipc_rmid(), which uses: ipcid_to_idx(ipcp->id) That truncates the real IDR index. An object actually stored at a high index can then be removed as if it lived at a low in-range index. 5. For shared memory, shm_destroy() frees the current object anyway, but the real high IDR slot is left behind as a dangling pointer. 6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry and dereferences freed memory. Prevent this by bounding the requested allocation to ipc_mni so the checkpoint/restore path fails once the valid range is exhausted.


Metrics

 
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:

NIST CVSS score
NIST: NVD
N/A
NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL Source(s) Tag(s)
https://access.redhat.com/security/cve/CVE-2026-52923 redhat-SADP Third Party Advisory 
https://bugzilla.redhat.com/show_bug.cgi?id=2492094 redhat-SADP Issue Tracking  Third Party Advisory 
https://git.kernel.org/stable/c/157ce2c6836ce0ff19108a819f38df061345425f kernel.org Patch 
https://git.kernel.org/stable/c/3bbe2bb9111ce6967a951bfac79af142d816fae5 kernel.org Patch 
https://git.kernel.org/stable/c/41058d4c3f63ab64901560a704882e0565f4e456 kernel.org Patch 
https://git.kernel.org/stable/c/8c58a92849175f5e2ab7bc2734b3b89afe79f6ef kernel.org Patch 
https://git.kernel.org/stable/c/a3cc795129e5ec0f8948653a3bf471e7d8852f5e kernel.org Patch 
https://git.kernel.org/stable/c/af24e202b543ded8a34f1d5d3db54eb916173f04 kernel.org Patch 
https://git.kernel.org/stable/c/bd4be70669af55b974860d13680348cfdf50bbed kernel.org Patch 
https://git.kernel.org/stable/c/fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139 kernel.org Patch 
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52923.json redhat-SADP Third Party Advisory 

Weakness Enumeration

CWE-ID CWE Name Source
CWE-401 Missing Release of Memory after Effective Lifetime cwe source acceptance level NIST  
CWE-825 Expired Pointer Dereference redhat-SADP  

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

7 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2026-52923
NVD Published Date:
06/24/2026
NVD Last Modified:
07/14/2026
Source:
kernel.org