CVE-2026-52947: Linux Kernel Use-After-Free Vulnerability

CVE-2026-52947 Overview

CVE-2026-52947 is a race condition vulnerability in the Linux kernel's Qualcomm IPC Router (QRTR) socket subsystem. The flaw resides in qrtr_port_remove() within net/qrtr/af_qrtr.c, where the socket reference count is decremented via __sock_put() before the port is removed from the qrtr_ports XArray and before the RCU grace period elapses. This sequencing violates the RCU update paradigm and creates a window where concurrent readers such as qrtr_reset_ports() or qrtr_port_lookup() can obtain a socket pointer whose refcount has already dropped to zero. The condition was reproduced through syzkaller fuzzing, triggering a refcount saturation warning and a potential Use-After-Free (UAF).

Critical Impact
A local attacker exploiting this race condition can trigger memory corruption in the kernel, leading to potential privilege escalation or denial of service on systems using QRTR sockets.

Affected Products

Linux kernel versions containing the vulnerable qrtr_port_remove() implementation in net/qrtr/af_qrtr.c
Systems with the QRTR (Qualcomm IPC Router) protocol module loaded, common on Qualcomm-based platforms
Distributions shipping kernels prior to the fix commits listed in stable kernel references

Discovery Timeline

2026-06-24 - CVE-2026-52947 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52947

Vulnerability Analysis

The Qualcomm IPC Router (QRTR) provides inter-process communication for Qualcomm hardware components. The kernel tracks active QRTR sockets in an XArray indexed by port number, with lookups protected by Read-Copy-Update (RCU). The cleanup function qrtr_port_remove() is responsible for tearing down a port and releasing the socket reference held by the XArray.

The original code path performed __sock_put() before calling xa_erase() and synchronize_rcu(). This ordering allows another CPU executing an RCU read-side critical section to retrieve the socket pointer from the XArray and invoke sock_hold() on a structure whose refcount is already zero. The result is either refcount saturation, which the kernel detects and logs, or freeing of memory that another path still references.

Root Cause

The root cause is an incorrect ordering of refcount and RCU operations [CWE-416, Use After Free]. The reference protecting concurrent readers must remain valid until after the XArray entry is removed and the RCU grace period completes. Decrementing the refcount before publication of the removal allows lookups to race with destruction.

Attack Vector

An unprivileged local process capable of creating and binding QRTR sockets can drive the race by repeatedly binding and unbinding ports while other threads perform lookups or trigger qrtr_reset_ports(). The syzkaller reproduction reached the vulnerable path through kernel_bind() → qrtr_bind() → __qrtr_bind() → qrtr_reset_ports(). Successful exploitation yields a Use-After-Free on a struct sock, which is a well-studied primitive for kernel privilege escalation.

No verified public exploit code is available. The vulnerability mechanism is described in the upstream commit messages referenced below; consult the Linux Kernel Commit 03bfa95e for the authoritative fix.

Detection Methods for CVE-2026-52947

Indicators of Compromise

Kernel log entries containing refcount_t: saturated; leaking memory originating from refcount_warn_saturate in lib/refcount.c
Stack traces in dmesg referencing qrtr_reset_ports, qrtr_port_lookup, or qrtr_port_remove from the qrtr module
Unexpected kernel oops or panic events on hosts running the QRTR module, particularly under fuzzing or high socket churn

Detection Strategies

Audit running kernel versions across the fleet and compare against the patched stable releases referenced in the upstream commits
Enable CONFIG_REFCOUNT_FULL and kernel address sanitizer (KASAN) in lab environments to surface refcount and UAF anomalies during testing
Monitor for loading of the qrtr kernel module on systems where it is not required as part of standard operation

Monitoring Recommendations

Forward kernel ring buffer logs to a centralized log platform and alert on refcount_warn_saturate and qrtr stack frames
Track creation of AF_QRTR sockets through audit subsystem rules to identify unusual local activity
Correlate kernel warnings with process execution telemetry to identify the originating workload

How to Mitigate CVE-2026-52947

Immediate Actions Required

Apply the patched Linux kernel from your distribution vendor that incorporates the upstream fix repositioning __sock_put() after xa_erase() and synchronize_rcu()
Inventory systems with the qrtr module loaded and prioritize patching on Qualcomm-based platforms where QRTR is in active use
Restrict local access on multi-tenant systems until the kernel update is deployed

Patch Information

The fix defers the reference count decrement until after the XArray entry is erased and the RCU grace period completes. Patched commits are available in the stable trees: Linux Kernel Commit 03bfa95e, Linux Kernel Commit 2047c2aa, Linux Kernel Commit 2aa4c127, Linux Kernel Commit 3b20ec8f, Linux Kernel Commit 474293d9, Linux Kernel Commit 7de2d447, Linux Kernel Commit a2171131, and Linux Kernel Commit ab269990.

Workarounds

Blacklist the qrtr kernel module on systems that do not require Qualcomm IPC Router functionality
Prevent automatic module loading by adding install qrtr /bin/true to a file under /etc/modprobe.d/
Apply seccomp or other syscall restrictions to block creation of AF_QRTR sockets by untrusted local users

bash

# Configuration example
# Disable the qrtr module on systems that do not need QRTR
echo 'blacklist qrtr' | sudo tee /etc/modprobe.d/disable-qrtr.conf
echo 'install qrtr /bin/true' | sudo tee -a /etc/modprobe.d/disable-qrtr.conf
sudo update-initramfs -u

# Verify the module is not currently loaded
lsmod | grep qrtr