{
  "threat_severity" : "Important",
  "public_date" : "2026-06-24T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: ipc: limit next_id allocation to the valid ID range",
    "id" : "2492094",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2492094"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-825",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nipc: limit next_id allocation to the valid ID range\nThe checkpoint/restore sysctl path can request the next SysV IPC id\nthrough ids->next_id.  ipc_idr_alloc() currently forwards that request to\nidr_alloc() with an open-ended upper bound.\nIf the valid tail of the SysV IPC id space is full, the allocation can\nspill beyond ipc_mni.  The returned SysV IPC id still uses the normal\nindex encoding, so later lookup and removal can target the wrong slot. \nThis leaves the real IDR entry behind and breaks the IDR state for the\nobject.\nThe bug is in ipc_idr_alloc() in the checkpoint/restore path.\n1. ids->next_id is passed to:\nidr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...)\n2. The zero upper bound makes the allocation effectively open-ended.\nOnce the valid SysV IPC tail is occupied, idr_alloc() can spill past\nipc_mni and allocate an entry beyond the valid IPC id range.\n3. The new object id is still encoded with the narrower SysV IPC index\nwidth:\nnew->id = (new->seq << ipcmni_seq_shift()) + idx\n4. Later removal goes through ipc_rmid(), which uses:\nipcid_to_idx(ipcp->id)\nThat truncates the real IDR index. An object actually stored at a\nhigh index can then be removed as if it lived at a low in-range\nindex.\n5. For shared memory, shm_destroy() frees the current object anyway, but\nthe real high IDR slot is left behind as a dangling pointer.\n6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry\nand dereferences freed memory.\nPrevent this by bounding the requested allocation to ipc_mni so the\ncheckpoint/restore path fails once the valid range is exhausted.", "A flaw was found in the Linux kernel. The `ipc_idr_alloc()` function, used in the checkpoint/restore path for SysV Inter-Process Communication (IPC) ID allocation, does not properly limit ID allocation to the valid range. This can result in the system attempting to dereference freed memory, leading to a use-after-free vulnerability. This issue could potentially cause system instability or information disclosure." ],
  "statement" : "SysV IPC checkpoint restore next_id allocation can escape the valid IPC id range because ipc_idr_alloc used an open ended idr_alloc upper bound. A crafted local sequence can leave a shared memory object stored in an out of range IDR slot, while later removal truncates the encoded id and removes a different in range slot. This can leave a stale IDR pointer to freed shared memory state, and a later /proc/sysvipc/shm walk can dereference freed memory. Impact is local denial of service.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-08-11T00:00:00Z",
    "advisory" : "RHSA-2026:53330",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "kernel-0:6.12.0-211.46.1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-08-10T00:00:00Z",
    "advisory" : "RHSA-2026:52764",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "kernel-0:6.12.0-55.95.1.el10_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
    "release_date" : "2026-09-03T00:00:00Z",
    "advisory" : "RHSA-2026:63189",
    "cpe" : "cpe:/a:redhat:rhel_extras_rt_els:7",
    "package" : "kernel-rt-0:3.10.0-1160.159.1.rt56.1311.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
    "release_date" : "2026-08-31T00:00:00Z",
    "advisory" : "RHSA-2026:61692",
    "cpe" : "cpe:/o:redhat:rhel_els:7",
    "package" : "kernel-0:3.10.0-1160.159.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-08-04T00:00:00Z",
    "advisory" : "RHSA-2026:49851",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.151.1.rt7.492.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-08-04T00:00:00Z",
    "advisory" : "RHSA-2026:49857",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-553.151.1.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
    "release_date" : "2026-07-28T00:00:00Z",
    "advisory" : "RHSA-2026:47248",
    "cpe" : "cpe:/o:redhat:rhel_aus:8.4",
    "package" : "kernel-0:4.18.0-305.200.1.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
    "release_date" : "2026-07-28T00:00:00Z",
    "advisory" : "RHSA-2026:47248",
    "cpe" : "cpe:/o:redhat:rhel_eus_long_life:8.4",
    "package" : "kernel-0:4.18.0-305.200.1.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2026-08-10T00:00:00Z",
    "advisory" : "RHSA-2026:52649",
    "cpe" : "cpe:/o:redhat:rhel_tus:8.8",
    "package" : "kernel-0:4.18.0-477.158.1.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2026-08-10T00:00:00Z",
    "advisory" : "RHSA-2026:52649",
    "cpe" : "cpe:/o:redhat:rhel_e4s:8.8",
    "package" : "kernel-0:4.18.0-477.158.1.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-31T00:00:00Z",
    "advisory" : "RHSA-2026:49212",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.33.1.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-31T00:00:00Z",
    "advisory" : "RHSA-2026:49212",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.33.1.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-08-07T00:00:00Z",
    "advisory" : "RHSA-2026:51603",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "kernel-0:5.14.0-284.186.1.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-08-07T00:00:00Z",
    "advisory" : "RHSA-2026:51604",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2::nfv",
    "package" : "kernel-rt-0:5.14.0-284.186.1.rt14.471.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
    "release_date" : "2026-07-31T00:00:00Z",
    "advisory" : "RHSA-2026:48386",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.4",
    "package" : "kernel-0:5.14.0-427.141.1.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2026-07-31T00:00:00Z",
    "advisory" : "RHSA-2026:49031",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "kernel-0:5.14.0-570.131.1.el9_6"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-52923\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-52923\nhttps://lore.kernel.org/linux-cve-announce/2026062431-CVE-2026-52923-35fb@gregkh/T" ],
  "name" : "CVE-2026-52923",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}