{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove\\n\\nIn qrtr_port_remove(), the socket reference count is decremented via\\n__sock_put() before the port is removed from the qrtr_ports XArray and\\nbefore the RCU grace period elapses.\\n\\nThis breaks the fundamental RCU update paradigm. It exposes a race\\nwindow where a concurrent RCU reader (such as qrtr_reset_ports() or\\nqrtr_port_lookup()) can obtain a pointer to the socket from the XArray,\\nand attempt to call sock_hold() on a socket whose reference count has\\nalready dropped to zero.\\n\\nThis exact race condition was hit during syzkaller fuzzing, leading to\\nthe following refcount saturation warning and a potential Use-After-Free:\\n\\n refcount_t: saturated; leaking memory.\\n WARNING: CPU: 3 PID: 1273 at lib\/refcount.c:22 refcount_warn_saturate+0xae\/0x1d0\\n Modules linked in: qrtr(+) bochs drm_shmem_helper …\\n Call Trace:\\n \\u003cTASK\\u003e\\n qrtr_reset_ports net\/qrtr\/af_qrtr.c:768 [inline] [qrtr]\\n __qrtr_bind.isra.0+0x48b\/0x570 net\/qrtr\/af_qrtr.c:805 [qrtr]\\n qrtr_bind+0x17d\/0x210 net\/qrtr\/af_qrtr.c:901 [qrtr]\\n kernel_bind+0xe4\/0x120 net\/socket.c:3592\\n qrtr_ns_init+0x1a6\/0x380 net\/qrtr\/ns.c:715 [qrtr]\\n qrtr_proto_init+0x3b\/0xff0 net\/qrtr\/af_qrtr.c:169 [qrtr]\\n do_one_initcall+0xf5\/0x5e0 init\/main.c:1283\\n …\\n \\u003c\/TASK\\u003e\\n\\nFix this by deferring the reference count decrement until after the\\nxa_erase() and the synchronize_rcu() complete.\\n\\n(Note: The v1 of this patch incorrectly replaced __sock_put() with\\nsock_put(). As Simon Horman pointed out, the callers of qrtr_port_remove()\\nstill hold a reference to the socket, so freeing the socket memory here\\nwould lead to a subsequent UAF in the caller. Thus, the __sock_put() is\\nkept, but only repositioned to close the RCU race.)”,”published”:”2026-06-24T16:26:05.062Z”,”modified”:”2026-06-28T06:37:05.590Z”,”type”:”cve”,”title”:”net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove”,”source”:”Linux”,”references”:”https:\/\/git.kernel.org\/stable\/c\/2aa4c12723fe432e623462a3be42a197a128722b\\nhttps:\/\/git.kernel.org\/stable\/c\/03bfa95e452e2b6ccd76a332060ae4feaf5ad84d\\nhttps:\/\/git.kernel.org\/stable\/c\/474293d90880622fde9d2430fb0165767090f7b3\\nhttps:\/\/git.kernel.org\/stable\/c\/2047c2aa0963bb2872fd722300a15bcb441a4c00\\nhttps:\/\/git.kernel.org\/stable\/c\/7de2d447072be3b1a76793f034432338fc9c494b\\nhttps:\/\/git.kernel.org\/stable\/c\/ab269990ed58143a92a263be1bee626d82ac03da\\nhttps:\/\/git.kernel.org\/stable\/c\/3b20ec8f31e8a6a6782243f473b0abd3463621df\\nhttps:\/\/git.kernel.org\/stable\/c\/a2171131ecda1ed61a594a1eb715e75fdad0fef5″,”id”:”CVE-2026-52947″,”bulletinFamily”:””,”cwe”:null,”cvelist”:null,”sourceData”:”Linux Linux bdabad3e363d825ddf9679dd431cca0b2c30f881\\nLinux Linux bdabad3e363d825ddf9679dd431cca0b2c30f881\\nLinux Linux bdabad3e363d825ddf9679dd431cca0b2c30f881\\nLinux Linux bdabad3e363d825ddf9679dd431cca0b2c30f881\\nLinux Linux bdabad3e363d825ddf9679dd431cca0b2c30f881\\nLinux Linux bdabad3e363d825ddf9679dd431cca0b2c30f881\\nLinux Linux bdabad3e363d825ddf9679dd431cca0b2c30f881\\nLinux Linux bdabad3e363d825ddf9679dd431cca0b2c30f881\\nLinux Linux 4.7″,”sourceHref”:””,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Linux”,”version”:”bdabad3e363d825ddf9679dd431cca0b2c30f881″,”vendor”:”Linux”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove\\n\\nIn qrtr_port_remove(), the socket reference count is…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,28,12,15,13,7,11,5],"class_list":["post-66543","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n