CVE-2026-52947

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove

In qrtr_port_remove(), the socket reference count is decremented via

__sock_put() before the port is removed from the qrtr_ports XArray and

before the RCU grace period elapses.

This breaks the fundamental RCU update paradigm. It exposes a race

window where a concurrent RCU reader (such as qrtr_reset_ports() or

qrtr_port_lookup()) can obtain a pointer to the socket from the XArray,

and attempt to call sock_hold() on a socket whose reference count has

already dropped to zero.

This exact race condition was hit during syzkaller fuzzing, leading to

the following refcount saturation warning and a potential Use-After-Free:

refcount_t: saturated; leaking memory.

WARNING: CPU: 3 PID: 1273 at lib/refcount.c:22 refcount_warn_saturate+0xae/0x1d0

Modules linked in: qrtr(+) bochs drm_shmem_helper ...

Call Trace:

<TASK>

qrtr_reset_ports net/qr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References