CVE-2026-52943

What it actually does

This is a Linux kernel use-after-free in the network socket buffer handling path. The vulnerable pskb_carve_inside_header() and pskb_carve_inside_nonlinear() helpers copy skb_shared_info, including the MSG_ZEROCOPY destructor_arg pointer, without incrementing the corresponding zerocopy reference count. When multiple copied socket buffers later release the same unaccounted ubuf_info_msgzc reference, the reference count can reach zero too early and free memory while other transmit socket buffers still hold live pointers to it. A local unprivileged attacker able to trigger the affected networking paths can exploit the stale pointer to corrupt kernel memory and escalate privileges to root. The description states this has been verified as reliably exploitable on a default kernel configuration, despite no KEV listing and low EPSS at the time of assessment.

Why it matters to the business

Successful exploitation gives a local user or process full administrative control of the affected Linux host. This can turn a low-privilege shell, compromised application account, container escape opportunity, or malicious insider access into complete host compromise, enabling data theft, persistence, service disruption, credential harvesting, and lateral movement. Because the flaw is in the Linux kernel, impact can extend across servers, workstations, appliances, containers sharing the host kernel, and embedded systems that run vulnerable kernel builds.

How an attack unfolds

An attacker first obtains the ability to run code as an unprivileged local user on a vulnerable Linux system. They then create network traffic patterns that use MSG_ZEROCOPY and exercise socket buffer carving paths, including pskb_carve_inside_header() or pskb_carve_inside_nonlinear(). The vulnerable kernel copies skb_shared_info structures containing a destructor_arg pointer but fails to acquire a matching zerocopy reference for the copied socket buffer. By repeatedly driving allocation, copying, release, and error/receive paths, the attacker causes the ubuf_info_msgzc object to be freed while another socket buffer still references it. The attacker then manipulates heap reuse so the dangling pointer references attacker-influenced memory, allowing controlled kernel memory corruption. With a reliable primitive, the exploit modifies kernel state or credentials and obtains root privileges.

How to fix it

Upgrade to a Linux kernel version that includes the upstream fix for the missing net_zcopy_get() calls in pskb_carve_inside_header() and pskb_carve_inside_nonlinear(). Because no product-specific fixed versions were provided, use the fixed kernel packages from the operating system or appliance vendor and verify that the relevant net/skbuff.c fix is included. Prioritize internet-facing multi-user systems, developer workstations, container hosts, shared compute platforms, and any environment where untrusted users or workloads can execute local code. If immediate patching is not possible, reduce local attack opportunities by limiting shell access, isolating untrusted workloads, applying least privilege, using kernel lockdown/hardening where supported, disabling or restricting unneeded networking features and protocols, and increasing monitoring for suspicious local privilege escalation activity. Mitigations should be treated as temporary because the vulnerable code is in core kernel networking behavior.

How to confirm the fix worked

Confirm the running kernel, not only the installed package, has been updated by checking uname -a, package manager kernel versions, and reboot status. Validate vendor advisories or changelogs for the backported fix referencing net: skbuff, pskb_carve_inside_header(), pskb_carve_inside_nonlinear(), MSG_ZEROCOPY, or missing zerocopy reference handling. Where source or debug symbols are available, confirm the patched logic calls net_zcopy_get() for copied skb_shared_info structures that retain destructor_arg. Perform negative testing in a controlled non-production environment using vendor regression tests or a safe reproducer to verify the host no longer triggers KASAN, panic, oops, or use-after-free symptoms. For fleet exposure checks, inventory all Linux kernel versions and map them to vendor fixed releases rather than relying solely on upstream version numbers, because distributions frequently backport fixes.

Typical attack path

1. Gain local code execution as an unprivileged user on a Linux system running a vulnerable kernel.
2. Create sockets and send data using MSG_ZEROCOPY to allocate zerocopy ubuf_info_msgzc state.
3. Trigger socket buffer carving through affected networking paths so skb_shared_info is copied without a matching net_zcopy_get() reference increment.
4. Force premature release of the shared zerocopy object while another socket buffer still holds destructor_arg pointing to the freed object.
5. Shape kernel heap reuse so the freed object is replaced with attacker-controlled or predictable data.
6. Trigger socket buffer cleanup to dereference the stale pointer and corrupt kernel memory.
7. Use the kernel memory corruption primitive to change process credentials or otherwise gain root-level execution.

How to detect it

Detecting prior exploitation is difficult because successful local kernel privilege escalation may not leave a unique application log entry. Review kernel logs, crash dumps, and centralized syslog for KASAN, slab use-after-free, kernel oops, panic, or skb_release_data-related faults. Investigate crashes or instability involving skb_release_data, kfree_skb_list_reason, skb_zcopy_clear, tcp_sendmsg_locked, tcp_recvmsg, ip_recv_error, rds_recvmsg, or RDS/TCP receive paths. Correlate such events with local user activity, new or modified setuid binaries, unexpected sudoers changes, new root-owned files in temporary directories, suspicious shell histories, anomalous process ancestry where a non-privileged user suddenly starts root shells or administrative tools, and EDR/audit events showing privilege changes without normal sudo, su, systemd, or policykit flows. If auditd or eBPF telemetry records socket options and syscalls, look for unusual MSG_ZEROCOPY-heavy socket activity by unprivileged users followed by privilege escalation. For systems with kernel sanitizers enabled, search for the exact KASAN use-after-free signatures described for this flaw. Absence of these artifacts does not rule out exploitation, especially if the exploit succeeds without crashing the kernel.

• BUG: KASAN: slab-use-after-free in skb_release_data
• slab-use-after-free in skb_release_data
• skb_release_data+0x77b/0x810
• kfree_skb_list_reason
• skb_zcopy_clear
• ubuf_info_msgzc
• msg_zerocopy_realloc
• tcp_sendmsg_locked
• ip_recv_error
• tcp_recvmsg
• rds_recvmsg
• pskb_carve_inside_header
• pskb_carve_inside_nonlinear
• destructor_arg
• MSG_ZEROCOPY

What your security team should do

• Treat this as a high-priority local privilege escalation issue for systems where untrusted users, build jobs, containers, or application service accounts can run code.
• Patch and reboot affected Linux systems using vendor kernel updates that include the skbuff zerocopy reference-counting fix.
• Prioritize shared Linux infrastructure, container hosts, CI/CD runners, bastion hosts, research environments, and systems with many local users.
• Inventory kernel versions across the fleet and distinguish patched backports from truly vulnerable builds.
• Review recent authentication, sudo, audit, EDR, and kernel logs for signs of unexpected privilege escalation or kernel memory corruption.
• Hunt for local exploit development artifacts, suspicious compilers or temporary binaries, and unusual use of raw networking or zerocopy socket behavior by non-administrative accounts.
• Limit local code execution paths until patching is complete, especially for low-trust users and workloads.
• Ensure kernel crash dumps, auditd, EDR telemetry, and centralized syslog collection are enabled on high-value Linux systems to support post-exploitation investigation.