CVE-2026-52943

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: fix missing zerocopy reference in pskb_carve helpers

pskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy

the old skb_shared_info header into a new buffer via memcpy(), which

includes the destructor_arg pointer (uarg) for MSG_ZEROCOPY skbs.

Neither function calls net_zcopy_get() for the new shinfo, creating an

unaccounted holder: every skb_shared_info with destructor_arg set will

call skb_zcopy_clear() once when freed, but the corresponding

net_zcopy_get() was never called for the new copy. Repeated calls

drive uarg->refcnt to zero prematurely, freeing ubuf_info_msgzc while

TX skbs still hold live destructor_arg pointers.

KASAN reports use-after-free on a freed ubuf_info_msgzc:

BUG: KASAN: slab-use-after-free in skb_release_data+0x77b/0x810

Read of size 8 at addr ffff88801574d3e8 by task poc/220

Call Trace:

skb_release_data+0x77b/0x810

kfree_skb_list_reason+0x13e/0x610

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References