CVE-2026-52947 (GCVE-0-2026-52947)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:26 – Updated: 2026-08-05 12:31
VLAI
Title
net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
Summary
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove In qrtr_port_remove(), the socket reference count is decremented via __sock_put() before the port is removed from the qrtr_ports XArray and before the RCU grace period elapses. This breaks the fundamental RCU update paradigm. It exposes a race window where a concurrent RCU reader (such as qrtr_reset_ports() or qrtr_port_lookup()) can obtain a pointer to the socket from the XArray, and attempt to call sock_hold() on a socket whose reference count has already dropped to zero. This exact race condition was hit during syzkaller fuzzing, leading to the following refcount saturation warning and a potential Use-After-Free: refcount_t: saturated; leaking memory. WARNING: CPU: 3 PID: 1273 at lib/refcount.c:22 refcount_warn_saturate+0xae/0x1d0 Modules linked in: qrtr(+) bochs drm_shmem_helper ... Call Trace: <TASK> qrtr_reset_ports net/qrtr/af_qrtr.c:768 [inline] [qrtr] __qrtr_bind.isra.0+0x48b/0x570 net/qrtr/af_qrtr.c:805 [qrtr] qrtr_bind+0x17d/0x210 net/qrtr/af_qrtr.c:901 [qrtr] kernel_bind+0xe4/0x120 net/socket.c:3592 qrtr_ns_init+0x1a6/0x380 net/qrtr/ns.c:715 [qrtr] qrtr_proto_init+0x3b/0xff0 net/qrtr/af_qrtr.c:169 [qrtr] do_one_initcall+0xf5/0x5e0 init/main.c:1283 ... </TASK> Fix this by deferring the reference count decrement until after the xa_erase() and the synchronize_rcu() complete. (Note: The v1 of this patch incorrectly replaced __sock_put() with sock_put(). As Simon Horman pointed out, the callers of qrtr_port_remove() still hold a reference to the socket, so freeing the socket memory here would lead to a subsequent UAF in the caller. Thus, the __sock_put() is kept, but only repositioned to close the RCU race.)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < 2aa4c12723fe432e623462a3be42a197a128722b (git)
Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < 03bfa95e452e2b6ccd76a332060ae4feaf5ad84d (git)
Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < 474293d90880622fde9d2430fb0165767090f7b3 (git)
Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < 2047c2aa0963bb2872fd722300a15bcb441a4c00 (git)
Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < 7de2d447072be3b1a76793f034432338fc9c494b (git)
Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < ab269990ed58143a92a263be1bee626d82ac03da (git)
Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < 3b20ec8f31e8a6a6782243f473b0abd3463621df (git)
Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < a2171131ecda1ed61a594a1eb715e75fdad0fef5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.7
Unaffected: 0 , < 4.7 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.94 , ≤ 6.12.* (semver)
Unaffected: 6.18.36 , ≤ 6.18.* (semver)
Unaffected: 7.0.13 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/qrtr/af_qrtr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2aa4c12723fe432e623462a3be42a197a128722b",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "03bfa95e452e2b6ccd76a332060ae4feaf5ad84d",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "474293d90880622fde9d2430fb0165767090f7b3",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "2047c2aa0963bb2872fd722300a15bcb441a4c00",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "7de2d447072be3b1a76793f034432338fc9c494b",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "ab269990ed58143a92a263be1bee626d82ac03da",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "3b20ec8f31e8a6a6782243f473b0abd3463621df",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "a2171131ecda1ed61a594a1eb715e75fdad0fef5",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/qrtr/af_qrtr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove\n\nIn qrtr_port_remove(), the socket reference count is decremented via\n__sock_put() before the port is removed from the qrtr_ports XArray and\nbefore the RCU grace period elapses.\n\nThis breaks the fundamental RCU update paradigm. It exposes a race\nwindow where a concurrent RCU reader (such as qrtr_reset_ports() or\nqrtr_port_lookup()) can obtain a pointer to the socket from the XArray,\nand attempt to call sock_hold() on a socket whose reference count has\nalready dropped to zero.\n\nThis exact race condition was hit during syzkaller fuzzing, leading to\nthe following refcount saturation warning and a potential Use-After-Free:\n\n  refcount_t: saturated; leaking memory.\n  WARNING: CPU: 3 PID: 1273 at lib/refcount.c:22 refcount_warn_saturate+0xae/0x1d0\n  Modules linked in: qrtr(+) bochs drm_shmem_helper ...\n  Call Trace:\n   \u003cTASK\u003e\n   qrtr_reset_ports net/qrtr/af_qrtr.c:768 [inline] [qrtr]\n   __qrtr_bind.isra.0+0x48b/0x570 net/qrtr/af_qrtr.c:805 [qrtr]\n   qrtr_bind+0x17d/0x210 net/qrtr/af_qrtr.c:901 [qrtr]\n   kernel_bind+0xe4/0x120 net/socket.c:3592\n   qrtr_ns_init+0x1a6/0x380 net/qrtr/ns.c:715 [qrtr]\n   qrtr_proto_init+0x3b/0xff0 net/qrtr/af_qrtr.c:169 [qrtr]\n   do_one_initcall+0xf5/0x5e0 init/main.c:1283\n   ...\n   \u003c/TASK\u003e\n\nFix this by deferring the reference count decrement until after the\nxa_erase() and the synchronize_rcu() complete.\n\n(Note: The v1 of this patch incorrectly replaced __sock_put() with\nsock_put(). As Simon Horman pointed out, the callers of qrtr_port_remove()\nstill hold a reference to the socket, so freeing the socket memory here\nwould lead to a subsequent UAF in the caller. Thus, the __sock_put() is\nkept, but only repositioned to close the RCU race.)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reachable through local AF_QIPCRTR datagram sockets via bind/autobind, sendmsg lookup, rebind, and close/release; QRTR transports are local IPC/internal device transports rather than Internet-facing network services. A local unprivileged process on a QRTR-enabled system can create and race these sockets.\nAC:L - Although this is a race, the attacker can control both sides by repeatedly removing bound QRTR ports while concurrently causing QRTR port lookups through local sends or other QRTR activity. Syzkaller reached the race, and there are no special external conditions beyond attacker-driven concurrency.\nPR:L - Creating AF_QIPCRTR sockets and binding ephemeral or high-numbered QRTR ports does not require CAP_NET_ADMIN or root. Control-port binding has extra checks, but exploitation does not depend on becoming the controller.\nUI:N - No victim action is required once the attacker has local code execution. The attacker can create sockets, bind/send/close them, and run the race directly.\nS:U - The corruption is within the kernel networking/QRTR subsystem and does not cross a separate security authority such as a VM, IOMMU, or sandbox boundary. A local kernel compromise remains unchanged scope.\nC:H - The bug is a potential use-after-free of a QRTR socket object reachable through stale XArray/RCU lookups and refcount resurrection. Per kernel scoring guidance, UAF memory corruption can be leveraged for high-impact information disclosure.\nI:H - A UAF on a kernel socket object can potentially be shaped with heap spraying into write or control-flow primitives. When uncertain, this should be scored as high integrity impact rather than only a crash.\nA:H - The observed failure is a refcount saturation warning on a stale socket reference, and the underlying UAF can lead to kernel oops, panic, or memory corruption. This is high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:58.784Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2aa4c12723fe432e623462a3be42a197a128722b"
        },
        {
          "url": "https://git.kernel.org/stable/c/03bfa95e452e2b6ccd76a332060ae4feaf5ad84d"
        },
        {
          "url": "https://git.kernel.org/stable/c/474293d90880622fde9d2430fb0165767090f7b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/2047c2aa0963bb2872fd722300a15bcb441a4c00"
        },
        {
          "url": "https://git.kernel.org/stable/c/7de2d447072be3b1a76793f034432338fc9c494b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab269990ed58143a92a263be1bee626d82ac03da"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b20ec8f31e8a6a6782243f473b0abd3463621df"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2171131ecda1ed61a594a1eb715e75fdad0fef5"
        }
      ],
      "title": "net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-52947",
    "datePublished": "2026-06-24T16:26:05.062Z",
    "dateReserved": "2026-06-09T07:44:35.371Z",
    "dateUpdated": "2026-08-05T12:31:58.784Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-52947",
      "date": "2026-09-22",
      "epss": "0.00135",
      "percentile": "0.03324"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:52:32.000Z",
      "cve": "CVE-2026-52947",
      "id": "msrc_CVE-2026-52947",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-52947.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/qrtr/af_qrtr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2aa4c12723fe432e623462a3be42a197a128722b",
                    "status": "affected",
                    "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "03bfa95e452e2b6ccd76a332060ae4feaf5ad84d",
                    "status": "affected",
                    "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "474293d90880622fde9d2430fb0165767090f7b3",
                    "status": "affected",
                    "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2047c2aa0963bb2872fd722300a15bcb441a4c00",
                    "status": "affected",
                    "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7de2d447072be3b1a76793f034432338fc9c494b",
                    "status": "affected",
                    "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ab269990ed58143a92a263be1bee626d82ac03da",
                    "status": "affected",
                    "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3b20ec8f31e8a6a6782243f473b0abd3463621df",
                    "status": "affected",
                    "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a2171131ecda1ed61a594a1eb715e75fdad0fef5",
                    "status": "affected",
                    "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/qrtr/af_qrtr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.7"
                  },
                  {
                    "lessThan": "4.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.94",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.36",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3FA30F1C-F514-4A35-83AD-10A879443A42",
                    "versionEndExcluding": "5.10.259",
                    "versionStartIncluding": "4.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801",
                    "versionEndExcluding": "5.15.210",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757",
                    "versionEndExcluding": "6.1.176",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C",
                    "versionEndExcluding": "6.6.143",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "85421C0C-ABDE-4357-971C-67F9087DE1B9",
                    "versionEndExcluding": "6.12.94",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "389025D2-958D-41BD-BD96-70ED1033A9F3",
                    "versionEndExcluding": "6.18.36",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E",
                    "versionEndExcluding": "7.0.13",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "1039E95A-8CC3-4C88-8FF9-5C08EEB861C9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove\n\nIn qrtr_port_remove(), the socket reference count is decremented via\n__sock_put() before the port is removed from the qrtr_ports XArray and\nbefore the RCU grace period elapses.\n\nThis breaks the fundamental RCU update paradigm. It exposes a race\nwindow where a concurrent RCU reader (such as qrtr_reset_ports() or\nqrtr_port_lookup()) can obtain a pointer to the socket from the XArray,\nand attempt to call sock_hold() on a socket whose reference count has\nalready dropped to zero.\n\nThis exact race condition was hit during syzkaller fuzzing, leading to\nthe following refcount saturation warning and a potential Use-After-Free:\n\n  refcount_t: saturated; leaking memory.\n  WARNING: CPU: 3 PID: 1273 at lib/refcount.c:22 refcount_warn_saturate+0xae/0x1d0\n  Modules linked in: qrtr(+) bochs drm_shmem_helper ...\n  Call Trace:\n   \u003cTASK\u003e\n   qrtr_reset_ports net/qrtr/af_qrtr.c:768 [inline] [qrtr]\n   __qrtr_bind.isra.0+0x48b/0x570 net/qrtr/af_qrtr.c:805 [qrtr]\n   qrtr_bind+0x17d/0x210 net/qrtr/af_qrtr.c:901 [qrtr]\n   kernel_bind+0xe4/0x120 net/socket.c:3592\n   qrtr_ns_init+0x1a6/0x380 net/qrtr/ns.c:715 [qrtr]\n   qrtr_proto_init+0x3b/0xff0 net/qrtr/af_qrtr.c:169 [qrtr]\n   do_one_initcall+0xf5/0x5e0 init/main.c:1283\n   ...\n   \u003c/TASK\u003e\n\nFix this by deferring the reference count decrement until after the\nxa_erase() and the synchronize_rcu() complete.\n\n(Note: The v1 of this patch incorrectly replaced __sock_put() with\nsock_put(). As Simon Horman pointed out, the callers of qrtr_port_remove()\nstill hold a reference to the socket, so freeing the socket memory here\nwould lead to a subsequent UAF in the caller. Thus, the __sock_put() is\nkept, but only repositioned to close the RCU race.)"
          }
        ],
        "id": "CVE-2026-52947",
        "lastModified": "2026-07-14T16:58:25.560",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-06-24T17:17:04.760",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/03bfa95e452e2b6ccd76a332060ae4feaf5ad84d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2047c2aa0963bb2872fd722300a15bcb441a4c00"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2aa4c12723fe432e623462a3be42a197a128722b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3b20ec8f31e8a6a6782243f473b0abd3463621df"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/474293d90880622fde9d2430fb0165767090f7b3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7de2d447072be3b1a76793f034432338fc9c494b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a2171131ecda1ed61a594a1eb715e75fdad0fef5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ab269990ed58143a92a263be1bee626d82ac03da"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T05:29:42+00:00",
      "cve": "CVE-2026-52947",
      "id": "CVE-2026-52947",
      "initial_release_date": "2026-06-24T00:00:00+00:00",
      "product_status:fixed": "762",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52947.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:53:04Z",
      "cve": "CVE-2026-52947",
      "id": "CVE-2026-52947",
      "initial_release_date": "2026-06-26T02:15:02Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "726",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-52947",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-52947.json",
      "version": "14"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.