CVE-2026-52923 Overview
CVE-2026-52923 is a Linux kernel vulnerability in the SysV inter-process communication (IPC) subsystem. The flaw resides in ipc_idr_alloc() on the checkpoint/restore (CRIU) sysctl path. When a caller requests a specific next IPC identifier through ids->next_id, the allocator forwards the request to idr_alloc() with an open-ended upper bound. Once the valid IPC identifier range is full, the allocation can spill beyond ipc_mni, leaving the IDR (integer ID radix) state inconsistent with the encoded SysV IPC id. Subsequent lookup and removal operations target the wrong slot, producing a dangling pointer that later code paths dereference.
Critical Impact
A local user with permission to write to the IPC checkpoint/restore sysctls can trigger a use-after-free of kernel memory by walking /proc/sysvipc/shm after the IDR state is corrupted.
Affected Products
- Linux kernel branches containing the unbounded ipc_idr_alloc() next_id path
- Distributions shipping the affected mainline and stable kernel trees
- Systems exposing the checkpoint/restore IPC sysctls to privileged user space (CRIU workloads, containers)
Discovery Timeline
- 2026-06-24 - CVE-2026-52923 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-52923
Vulnerability Analysis
The defect is a missing bounds check in the SysV IPC identifier allocator. The checkpoint/restore sysctl path lets user space request a specific next IPC id through ids->next_id. The current implementation calls idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...), where the zero upper bound makes the allocation effectively unbounded. Once the valid SysV IPC tail is occupied, idr_alloc() can return an index beyond ipc_mni, the maximum number of IPC identifiers.
The newly created object encodes its id using the narrower SysV IPC index width through new->id = (new->seq << ipcmni_seq_shift()) + idx. Later removal goes through ipc_rmid(), which applies ipcid_to_idx(ipcp->id) and truncates the real IDR index. An object actually stored at a high index is then removed as if it lived at a low in-range index, leaving the real high IDR slot behind as a dangling reference to freed memory.
Root Cause
The root cause is an input validation error [CWE-20] combined with index truncation. The allocator accepts an untrusted target index without clamping it to ipc_mni, while the id-encoding logic assumes the index always fits within the SysV IPC index width.
Attack Vector
A local attacker with rights to write the IPC checkpoint/restore sysctls fills the valid IPC tail and then drives ipc_idr_alloc() to spill beyond ipc_mni. For shared memory, shm_destroy() frees the current object, but the high IDR slot remains. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry and dereferences freed memory, leading to a use-after-free condition exploitable for kernel memory corruption or privilege escalation. The vulnerability mechanism is described in detail in the upstream commits; see the Linux Kernel Commit for the canonical fix.
Detection Methods for CVE-2026-52923
Indicators of Compromise
- Kernel oops or panic referencing ipc_rmid, shm_destroy, or sysvipc_proc_show with use-after-free signatures from KASAN.
- Unexpected writes to /proc/sys/kernel/{sem,msg,shm}_next_id from non-CRIU workloads.
- Process activity reading /proc/sysvipc/shm, /proc/sysvipc/msg, or /proc/sysvipc/sem immediately after IPC creation bursts.
Detection Strategies
- Audit kernel versions against the patched commits listed in the kernel.org references to identify exposed hosts.
- Monitor for processes invoking sysctl writes to kernel.shm_next_id, kernel.msg_next_id, or kernel.sem_next_id outside checkpoint/restore tooling.
- Correlate kernel log entries with KASAN or slub_debug reports indicating freed IPC objects accessed during /proc/sysvipc reads.
Monitoring Recommendations
- Enable kernel auditd rules covering /proc/sys/kernel/*_next_id write events and forward them to a centralized log store.
- Track creation rates of SysV shared memory segments and semaphore sets that approach ipc_mni thresholds.
- Alert on unexplained kernel crash dumps or BUG: KASAN strings referencing the ipc subsystem.
How to Mitigate CVE-2026-52923
Immediate Actions Required
- Apply the upstream kernel patches from the references and reboot affected hosts onto the fixed build.
- Restrict write access to the IPC checkpoint/restore sysctls so only trusted CRIU operators can modify *_next_id values.
- Inventory containers and CRIU-enabled workloads that legitimately need the checkpoint/restore path and isolate untrusted tenants from those hosts.
Patch Information
The fix bounds the requested allocation to ipc_mni so the checkpoint/restore path fails cleanly once the valid range is exhausted. Patches are available across stable branches via the kernel.org tree, including commit 157ce2c6, commit 3bbe2bb9, commit 41058d4c, commit 8c58a928, commit a3cc7951, commit af24e202, commit bd4be706, and commit fa0b9b2b. Pull the patched kernel from your distribution vendor once it is published.
Workarounds
- Disable or restrict CRIU functionality on hosts that do not require checkpoint/restore.
- Use seccomp or LSM policies to block writes to /proc/sys/kernel/{shm,msg,sem}_next_id from untrusted containers.
- Lower exposure by ensuring container runtimes do not grant CAP_SYS_ADMIN or sysctl write rights to tenant workloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
