CVE-2026-52923PoC(linux / linux_kernel)

HIGHCVSS 7.8 · HIGH

Exploitation observed; activity peaked at 6 mentions and remains active

Immediate actions

Patch linux linux_kernel systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: ipc: limit next_id allocation to the valid ID range The checkpoint/restore sysctl path can request the next SysV IPC id through ids->next_id. ipc_idr_alloc() currently forwards that request to idr_alloc() with an open-ended upper bound. If the valid tail of the SysV IPC id space is full, the allocation can spill beyond ipc_mni. The returned SysV IPC id still uses the normal index encoding, so later lookup and removal can target the wrong slot. This leaves the real IDR entry behind and breaks the IDR state for the object. The bug is in ipc_idr_alloc() in the checkpoint/restore path. 1. ids->next_id is passed to: idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...) 2. The zero upper bound makes the allocation effectively open-ended. Once the valid SysV IPC tail is occupied, idr_alloc() can spill past ipc_mni and allocate an entry beyond the valid IPC id range. 3. The new object id is still encoded with the narrower SysV IPC index width: new->id = (new->seq << ipcmni_seq_shift()) + idx 4. Later removal goes through ipc_rmid(), which uses: ipcid_to_idx(ipcp->id) That truncates the real IDR index. An object actually stored at a high index can then be removed as if it lived at a low in-range index. 5. For shared memory, shm_destroy() frees the current object anyway, but the real high IDR slot is left behind as a dangling pointer. 6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry and dereferences freed memory. Prevent this by bounding the requested allocation to ipc_mni so the checkpoint/restore path fails once the valid range is exhausted.

linux CVEs Back to dashboard

7.5/ 10 priority

Sources & remediation

Patch / fix

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-401CWE-825

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

linux_kernel

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
10 mentions across 5 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 4 signals
PoC mentioned or linked in 8 signals
Patch or workaround mentioned in 3 signals
Technical details provided in 7 signals
Disclosure: 1 classified signal
Peaked 3d ago at 6 mentions (2026-08-25); latest day: 1
10 total mentions across 5 days

Affected systems

Vendors

linux

Products

linux_kernel

2 versions affected across 1 product

Deep dive

Activity timeline10 mentions / 5d

Signal classification5 categories

PoC

444.4%

Exploit

222.2%

Disclosure

111.1%

Active Exploitation

111.1%

Patch

111.1%

Referenced assets15 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-24	1	Disclosure1
2026-08-25	6	Exploit2PoC4
2026-09-12	1	Active Exploitation1
2026-09-15	1	Patch1

Full discourse10 posts

Nebula Security@nebusecurity30d
Exploit
Today's exploit targets a 13-year-old UAF in Red Hat Enterprise Linux 10: CVE-2026-52923. It was introduced in Jan 2013 and fixed upstream in May 2026, backported to RHEL on Aug 11. Discovered and exploited by the NebuSec security pipeline. EXP source: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52923-RHEL-6.12.0-211.7.3.el10_2 https://t.co/TnB5Kjl8wW
Post summary
NebuSec released a working exploit for CVE‑2026‑52923, a 13‑year‑old use‑after‑free in RHEL 10; the vendor has patched it upstream and backported it to RHEL, and the PoC code is publicly available on GitHub.
1171104346.6K
6.9K followersView on X
ThreatWire@ThreatWire_30d
PoC
🚨 HIGH: A public PoC for CVE-2026-52923 demonstrates local privilege escalation to root on affected Linux systems. The kernel flaw is a use-after-free in SysV IPC, triggered through the checkpoint/restore path and an invalid IPC ID allocation. CVSS 7.8 — local attackers can potentially gain kernel-level control. 🔗 https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52923-RHEL-6.12.0-211.7.3.el10_2 #Linux #Kernel #CVE #LPE #PoC #CyberSecurity #Infosec
Post summary
The tweet announces a public proof‑of‑concept for CVE‑2026‑52923 that demonstrates a use‑after‑free leading to root on Linux, with technical details and a GitHub repository link to the code.
0302781.7K
1.5K followersView on X
dbugs@ptdbugs30d
Exploit
A PoC/exploit has been discovered for vulnerability CVE-2026-52923 Vendor: Linux Product: Linux Kernel Description: An issue exists in the checkpoint/restore sysctl path where the ipc idr alloc() function forwards requests to idr alloc() with an open-ended upper bound. When the valid SysV IPC id space is full, allocations can exceed ipc mni, resulting in IDs that use normal index encoding but target incorrect slots during lookup and removal. This process breaks the IDR state and can leave a dangling pointer in the IDR entry. Specifically, for shared memory, shm destroy() may free an object while leaving a stale entry that, when accessed via /proc/sysvipc/shm, leads to a dereference of freed memory. The flaw is located in the ipc idr alloc() function, specifically when ids->next id is passed to idr alloc() with a zero upper bound. Link: https://github.com/NebuSec/CyberMeowfia/blob/main/security-research/Linux-CVE-2026-52923-RHEL-6.12.0-211.7.3.el10_2/exploit.c #dbugs_vuln
Post summary
A PoC with a functional exploit script for CVE-2026-52923 has been released, detailing a kernel IDR manipulation that can lead to dangling pointers and memory dereference.
0202181.4K
3.6K followersView on X
moton@moton30d
PoC
CVE-2026-52923 PoC Lets Users Escalate to Root Privilege - https://securityonline.info/cve-2026-52923-linux-kernel-flaw/
Post summary
The text announces a Proof of Concept that enables users to achieve root privilege escalation on the Linux kernel, linking to an external article for further details.
040144756
756 followersView on X
Cyber Meowfia@cybermeowfia24d
Aug 24: exploit for a 13-year-old UAF in Red Hat Enterprise Linux 10: CVE-2026-52923. It was introduced in Jan 2013 and fixed upstream in May 2026, backported to RHEL on Aug 11. Discovered and exploited by the NebuSec security pipeline. EXP source: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52923-RHEL-6.12.0-211.7.3.el10_2 https://t.co/gjNUNXjCYb
0101201.8K
437 followersView on X
Mr. OS@ksg93rd12d
Active Exploitation
#Analytics #Threat_Research An analytical review of the main cybersecurity events (Sep 05-12, 2026) 1⃣ Sonicwall SMA1000 Attack https://hunt.io/blog/sonicwall-sma1000-uk-council-attack // CVE-2026-15409 2⃣ Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability https://hunt.io/blog/sonicwall-sma1000-uk-council-attack 3⃣ Next Nightmare Eclipse Vulnerability https://github.com/MSNightmare/ShieldCrash/blob/main/README.md // Microsoft has failed to properly patch ShieldBreak CVE-2026-69414.. 4⃣ FortiPAM Vulnerability https://amibeingpwned.com/blog/fortinet-pam-vuln // CVE-2026-84388 5⃣ Researchers from Nebula Security have disclosed 18 vulnerabilities in the Linux kernel https://www.openwall.com/lists/oss-security/2026/09/08/1 // CVE-2026-80714, CVE-2026-74597, CVE-2026-74581, CVE-2026-74480, CVE-2026-72255, CVE-2026-72137, CVE-2026-68376, CVE-2026-68162, CVE-2026-64560, CVE-2026-63834, CVE-2026-52933, CVE-2026-52929, CVE-2026-52924, CVE-2026-52923, CVE-2026-52912, CVE-2026-43501, CVE-2026-43502, CVE-2026-43074, CVE-2026-43042, CVE-2026-31678, CVE-2026-31659, CVE-2026-23274 6⃣ Netscaler ADC Exploit 7⃣ Critical vulnerabilities in MikroTik RouterOS https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ 8⃣ GRAYRABBIT One-click backdoor // One click. Three critical failures. One backdoor https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou 9⃣ Attacks using browser-in-browser (BiTB) phishing techniques https://www.huntress.com/blog/phishing-bitb-rmm-attacks 🔟 Beltdown: Escaping the Claude Code sandbox https://www.accomplish.ai/blog/beltdown-escaping-the-claude-code-sandbox/ // An untrusted repository opened in Claude Code can escape the macOS sandbox and run commands on your computer as your privileged user http://www.Geniebot.pro http://www.cyberpocket.org
Post summary
The post highlights a mix of recent CVEs, with the main takeaway being that MikroTik RouterOS vulnerabilities are actively exploited, while no concrete patches, detailed technical info, or exploit tools are disclosed.
01052560
3.4K followersView on X
Rıdvan Yağlı@ridvanyagli30d
PoC
🔴 Linux kernel için CVE-2026-52923 kapsamında bir exploit yayınlandı. 13 yıl önce ortaya çıkan ve uzun süre fark edilmeyen güvenlik açığı, güncel RHEL 10 kernel sürümlerini etkiliyor. SysV IPC'deki ID tahsis mekanizmasında bulunan bir Use-After-Free (UAF) hatasından kaynaklanıyor. Nebula Security tarafından yayınlanan PoC, açığın yerel kullanıcı tarafından istismar edilmesine yönelik bir exploit içeriyor. PoC: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52923-RHEL-6.12.0-211.7.3.el10_2 https://x.com/nebusecurity/status/2092153813247705486/video/1
Post summary
The post announces a PoC exploit for CVE‑2026‑52923, providing code that demonstrates a use‑after‑free vulnerability in RHEL 10 kernels, but does not mention active exploitation, patches, or debunking.
00031320
2.4K followersView on X
Daily CyberSecurity@Daily_CyberSec30d
PoC
A public PoC for the Linux kernel flaw CVE-2026-52923 allows local attackers to escalate to root privilege. Learn about the patch and technical details. #Linux #CVE202652923 #CyberSecurity #PrivilegeEscalation #KernelFlaw https://securityonline.info/cve-2026-52923-linux-kernel-flaw/
Post summary
The post announces a public proof‑of‑concept for CVE‑2026‑52923 that enables local privilege escalation to root and references an available patch and additional technical details.
00031443
13.0K followersView on X
Threat Landscape@LandscapeThreat9d
Patch
Researchers disclosed CVE-2026-43502, a Linux kernel local privilege-escalation vulnerability in the RDS zerocopy send path, alongside 20 additional exploitable Linux bugs. - An unprivileged local user can obtain root privileges without Linux capabilities or user namespaces when required networking, asynchronous I/O, and RDS components are enabled. - The vulnerability affects kernels from Linux v4.17 and was demonstrated on openSUSE with kernel 6.4.0-150600.23.100. - The issue was fixed by commit 44b550d88b26, first included in Linux v7.1-rc3; public exploits for the listed vulnerabilities are available. VULNERABILITY CVE-2026-23274 CVE-2026-31659 CVE-2026-31678 CVE-2026-43042 CVE-2026-43074 CVE-2026-43501 CVE-2026-43502 CVE-2026-52912 CVE-2026-52923 CVE-2026-52924 CVE-2026-52929 CVE-2026-52933 CVE-2026-63834 CVE-2026-64560 CVE-2026-68162 CVE-2026-68376 CVE-2026-72137 CVE-2026-72255 CVE-2026-74480 CVE-2026-74581 CVE-2026-74597 CVE-2026-80714
Post summary
The text discloses CVE-2026-43502 and related Linux kernel privilege-escalation bugs, provides technical impact details, notes public exploits are available, and identifies the fixing commit and fixed kernel release.
0002045
76 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds92d
Disclosure
CVE-2026-52923 Linux Kernel SysV IPC ID Allocation Buffer Overflow Beyond Valid Range https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-52923
Post summary
The post announces a newly disclosed Linux kernel vulnerability (CVE-2026-52923) describing a buffer overflow in SysV IPC ID allocation, but does not mention PoCs, exploits, or patches.
00000140
4.1K followersView on X

CPE platform detail12 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

12 of 12 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	linux	linux_kernel	-	-	-
OS	linux	linux_kernel	3.8	-	-
OS	linux	linux_kernel	3.8	-	-
OS	linux	linux_kernel	3.8	-	-
OS	linux	linux_kernel	3.8	-	-
OS	linux	linux_kernel	3.8	-	-
OS	linux	linux_kernel	3.8	-	-
OS	linux	linux_kernel	7.1	-	-
OS	linux	linux_kernel	7.1	-	-
OS	linux	linux_kernel	7.1	-	-
OS	linux	linux_kernel	7.1	-	-
OS	linux	linux_kernel	7.1	-	-

Explore more

Back to dashboard linux CVEs linux_kernel vulnerabilities

What researchers are saying

CVE-2026-52923

Nebula Security[verified]@nebusecurityExploit

NebuSec released a working exploit for CVE‑2026‑52923, a 13‑year‑old use‑after‑free in RHEL 10; the vendor has patched it upstream and backported it to RHEL, and the PoC code is publicly available on GitHub.

ThreatWire[verified]@ThreatWire_PoC

The tweet announces a public proof‑of‑concept for CVE‑2026‑52923 that demonstrates a use‑after‑free leading to root on Linux, with technical details and a GitHub repository link to the code.

dbugs[verified]@ptdbugsExploit

A PoC with a functional exploit script for CVE-2026-52923 has been released, detailing a kernel IDR manipulation that can lead to dangling pointers and memory dereference.

Rıdvan Yağlı[verified]@ridvanyagliPoC

The post announces a PoC exploit for CVE‑2026‑52923, providing code that demonstrates a use‑after‑free vulnerability in RHEL 10 kernels, but does not mention active exploitation, patches, or debunking.

Threat Landscape[verified]@LandscapeThreatPatch

The text discloses CVE-2026-43502 and related Linux kernel privilege-escalation bugs, provides technical impact details, notes public exploits are available, and identifies the fixing commit and fixed kernel release.

moton@motonPoC

The text announces a Proof of Concept that enables users to achieve root privilege escalation on the Linux kernel, linking to an external article for further details.

Mr. OS@ksg93rdActive Exploitation

The post highlights a mix of recent CVEs, with the main takeaway being that MikroTik RouterOS vulnerabilities are actively exploited, while no concrete patches, detailed technical info, or exploit tools are disclosed.

Daily CyberSecurity@Daily_CyberSecPoC

The post announces a public proof‑of‑concept for CVE‑2026‑52923 that enables local privilege escalation to root and references an available patch and additional technical details.