CVE-2026-52943: Linux Kernel Privilege Escalation Flaw

CVE-2026-52943 Overview

CVE-2026-52943 is a use-after-free vulnerability in the Linux kernel networking stack. The flaw affects the pskb_carve_inside_header() and pskb_carve_inside_nonlinear() helpers in net/core/skbuff.c. Both functions copy the old skb_shared_info header into a new buffer with memcpy(), including the destructor_arg pointer used by MSG_ZEROCOPY socket buffers. Neither helper calls net_zcopy_get() on the new shinfo, leaving the reference count unbalanced. Repeated socket operations drive uarg->refcnt to zero prematurely, freeing the ubuf_info_msgzc while transmit skbs still hold live destructor_arg pointers. The defect has been verified as reliably exploitable for local privilege escalation on default kernel configurations.

Critical Impact
A working proof-of-concept achieves full root privilege escalation from an unprivileged local user on default Linux kernel configurations.

Affected Products

Linux kernel (mainline and stable branches containing pskb_carve_inside_header() and pskb_carve_inside_nonlinear())
Distributions shipping affected stable kernel versions prior to the upstream fix
Workloads using MSG_ZEROCOPY send paths over TCP

Discovery Timeline

2026-06-24 - CVE-2026-52943 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52943

Vulnerability Analysis

The Linux kernel's socket buffer (skb) subsystem supports MSG_ZEROCOPY, a feature that avoids copying user data into kernel buffers during transmit. Zerocopy skbs carry a ubuf_info_msgzc structure referenced through skb_shared_info->destructor_arg and tracked by a refcount. The helpers pskb_carve_inside_header() and pskb_carve_inside_nonlinear() reshape skbs by allocating a new data area and copying the existing skb_shared_info header with memcpy(). That copy duplicates destructor_arg without incrementing the underlying uarg reference. When each resulting skb is later released, skb_zcopy_clear() decrements the same refcount that was only incremented once. The imbalance causes premature free of ubuf_info_msgzc while other in-flight skbs still dereference it.

Root Cause

The root cause is a missing net_zcopy_get() call in both pskb_carve helpers. The duplication of destructor_arg via memcpy() of the shinfo header creates an unaccounted holder of the zerocopy ubuf. The sibling routine pskb_expand_head() already follows the correct pattern by acquiring a reference after skb_orphan_frags() succeeds. The carve helpers diverged from that pattern, producing a use-after-free condition classified under Use-After-Free memory corruption.

Attack Vector

An unprivileged local user can trigger the imbalance by issuing MSG_ZEROCOPY sends on TCP sockets and inducing skb carving on the receive path. KASAN traces from the reported issue show allocation in msg_zerocopy_realloc() reached through tcp_sendmsg_locked(), with the free occurring through ip_recv_error() and tcp_recvmsg(). The late dereference appears in skb_release_data() invoked by kfree_skb_list_reason() during rds_tcp_inc_free() and rds_recvmsg(). The freed ubuf_info_msgzc object can be reclaimed by attacker-controlled allocations to achieve kernel control-flow hijack and local privilege escalation.

No public exploit code is referenced in the advisory. See the upstream kernel fix for the corrected reference accounting in both carve helpers.

Detection Methods for CVE-2026-52943

Indicators of Compromise

KASAN reports of slab-use-after-free in skb_release_data involving objects allocated by msg_zerocopy_realloc.
Kernel oops or panic stack traces traversing kfree_skb_list_reason, rds_tcp_inc_free, or tcp_recvmsg paths.
Unexpected kernel crashes correlated with workloads using MSG_ZEROCOPY TCP sends.

Detection Strategies

Enable KASAN on test and pre-production kernels to surface use-after-free conditions in the skbuff subsystem.
Audit kernel build versions across the fleet against the patched commits listed on git.kernel.org for this CVE.
Monitor for unprivileged processes executing sequences of TCP sendmsg with MSG_ZEROCOPY flags followed by error-queue draining via recvmsg.

Monitoring Recommendations

Forward dmesg and kernel crash logs to a centralized log pipeline and alert on KASAN signatures referencing skb_release_data or ubuf_info_msgzc.
Track per-process syscall telemetry for anomalous setsockopt(SO_ZEROCOPY) usage by non-server workloads.
Correlate kernel crash events with preceding socket activity from the same task to identify exploitation attempts.

How to Mitigate CVE-2026-52943

Immediate Actions Required

Apply the upstream Linux kernel patches that add net_zcopy_get() to pskb_carve_inside_header() and pskb_carve_inside_nonlinear().
Rebuild and deploy distribution kernels containing the fix commits referenced on git.kernel.org.
Restrict local shell and container escape primitives until patched kernels are deployed across all hosts.

Patch Information

The fix mirrors the reference-counting pattern of pskb_expand_head(). In pskb_carve_inside_header(), net_zcopy_get() is invoked after skb_orphan_frags() succeeds, so the orphan error path requires no cleanup. In pskb_carve_inside_nonlinear(), net_zcopy_get() is invoked after all failure points and immediately before skb_release_data(), removing the need for a balancing net_zcopy_put(). Patch commits are published at the Linux stable tree, with additional backports referenced in the related kernel commit set.

Workarounds

Disable MSG_ZEROCOPY in applications by removing SO_ZEROCOPY socket options where feasible until kernels are patched.
Limit local user access on systems running vulnerable kernels and enforce mandatory access controls such as SELinux or AppArmor.
Apply seccomp filters to constrain setsockopt and sendmsg flag usage for untrusted workloads.

bash

# Identify the running kernel and verify against patched stable commits
uname -r
# Confirm whether MSG_ZEROCOPY is in use on the system
ss -tieam | grep -i zerocopy