{"id":"CVE-2026-52947","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove\n\nIn qrtr_port_remove(), the socket reference count is decremented via\n__sock_put() before the p…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove\n\nIn qrtr_port_remove(), the socket reference count is decremented via\n__sock_put() before the p…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","published":"2026-06-24","updated":"2026-07-10","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52947","references":[{"url":"https://git.kernel.org/stable/c/03bfa95e452e2b6ccd76a332060ae4feaf5ad84d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2047c2aa0963bb2872fd722300a15bcb441a4c00","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2aa4c12723fe432e623462a3be42a197a128722b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b20ec8f31e8a6a6782243f473b0abd3463621df","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/474293d90880622fde9d2430fb0165767090f7b3","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7de2d447072be3b1a76793f034432338fc9c494b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a2171131ecda1ed61a594a1eb715e75fdad0fef5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ab269990ed58143a92a263be1bee626d82ac03da","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52947.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-52947"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492432"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52947"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52947"},{"url":"https://lore.kernel.org/linux-cve-announce/2026062402-CVE-2026-52947-8205@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:65334"},{"url":"https://access.redhat.com/errata/RHSA-2026:67150"},{"url":"https://access.redhat.com/errata/RHSA-2026:67468"},{"url":"https://access.redhat.com/errata/RHSA-2026:67469"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00135,"epssPercentile":0.0332,"ingestedAt":"2026-07-11T13:13:24.766Z","vendor":"Red Hat","product":"Red Hat Enterprise Linux BaseOS (v. 10)","affected":["enterprise_linux 8","enterprise_linux 9","enterprise_linux_appstream_v_10","enterprise_linux_baseos_v_10","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_real_time_v_10"],"patched":["enterprise_linux_appstream_v_10","enterprise_linux_baseos_v_10","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_real_time_v_10"],"cwe":["CWE-911"],"scores":{"nvd":7.8,"vendor":7},"slug":"CVE-2026-52947","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove\n\nIn qrtr_port_remove(), the socket reference count is decremented via\n__sock_put() before the port is removed from the qrtr_ports XArray and\nbefore the RCU grace period elapses.\n\nThis breaks the fundamental RCU update paradigm. It exposes a race\nwindow where a concurrent RCU reader (such as qrtr_reset_ports() or\nqrtr_port_lookup()) can obtain a pointer to the socket from the XArray,\nand attempt to call sock_hold() on a socket whose reference count has\nalready dropped to zero.\n\nThis exact race condition was hit during syzkaller fuzzing, leading to\nthe following refcount saturation warning and a potential Use-After-Free:\n\n  refcount_t: saturated; leaking memory.\n  WARNING: CPU: 3 PID: 1273 at lib/refcount.c:22 refcount_warn_saturate+0xae/0x1d0\n  Modules linked in: qrtr(+) bochs drm_shmem_helper ...\n  Call Trace:\n   <TASK>\n   qrtr_reset_ports net/qrtr/af_qrtr.c:768 [inline] [qrtr]\n   __qrtr_bind.isra.0+0x48b/0x570 net/qrtr/af_qrtr.c:805 [qrtr]\n   qrtr_bind+0x17d/0x210 net/qrtr/af_qrtr.c:901 [qrtr]\n   kernel_bind+0xe4/0x120 net/socket.c:3592\n   qrtr_ns_init+0x1a6/0x380 net/qrtr/ns.c:715 [qrtr]\n   qrtr_proto_init+0x3b/0xff0 net/qrtr/af_qrtr.c:169 [qrtr]\n   do_one_initcall+0xf5/0x5e0 init/main.c:1283\n   ...\n   </TASK>\n\nFix this by deferring the reference count decrement until after the\nxa_erase() and the synchronize_rcu() complete.\n\n(Note: The v1 of this patch incorrectly replaced __sock_put() with\nsock_put(). As Simon Horman pointed out, the callers of qrtr_port_remove()\nstill hold a reference to the socket, so freeing the socket memory here\nwould lead to a subsequent UAF in the caller. Thus, the __sock_put() is\nkept, but only repositioned to close the RCU race.)\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:65334** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65334)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52947.json)\n- **RHSA-2026:67150** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67150)\n- **RHSA-2026:67468** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67468)\n- **RHSA-2026:67469** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67469)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}