In the Linux kernel, the following vulnerability has been resolved:

ipc/shm: serialize orphan cleanup with shm_nattch updates

shm_destroy_orphaned() walks the shm idr under shm_ids(ns).rwsem, but that
does not serialize all fields tested by shm_may_destroy(). In particular,
shm_nattch is updated while holding shm_perm.lock, and attach paths can do
that without holding the rwsem.

Do not decide that an orphaned segment is unused before taking the object
lock. Move the shm_may_destroy() check under shm_perm.lock, matching the
other destroy paths, and unlock the segment when it no longer qualifies
for removal.
Advisories
Source ID Title
Debian DLA Debian DLA DLA-4664-1 linux security update
Debian DLA Debian DLA DLA-4665-1 linux security update
Debian DLA Debian DLA DLA-4671-1 linux-6.1 security update
Ubuntu USN Ubuntu USN USN-8726-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8727-1 Linux kernel (OEM) vulnerabilities
Ubuntu USN Ubuntu USN USN-8728-1 Linux kernel (GCP) vulnerabilities
Ubuntu USN Ubuntu USN USN-8760-1 Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN Ubuntu USN USN-8726-2 Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN Ubuntu USN USN-8726-3 Linux kernel (IBM) vulnerabilities
Ubuntu USN Ubuntu USN USN-8800-1 Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8760-2 Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN Ubuntu USN USN-8726-4 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8728-2 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-8728-3 Linux kernel (Oracle) vulnerabilities
Ubuntu USN Ubuntu USN USN-8876-1 Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN Ubuntu USN USN-8875-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8877-1 Linux kernel (GCP) vulnerabilities
Ubuntu USN Ubuntu USN USN-8878-1 Linux kernel (GCP) vulnerabilities
Ubuntu USN Ubuntu USN USN-8879-1 Linux kernel (Oracle) vulnerabilities
Ubuntu USN Ubuntu USN USN-8903-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8904-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-8905-1 Linux kernel (GCP) vulnerabilities
Ubuntu USN Ubuntu USN USN-8906-1 Linux kernel (IBM) vulnerabilities
Ubuntu USN Ubuntu USN USN-8875-2 Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN Ubuntu USN USN-8903-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8905-2 Linux kernel (GCP) vulnerabilities
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Thu, 15 Oct 2026 02:30:00 +0000


Tue, 08 Sep 2026 09:30:00 +0000

Type Values Removed Values Added
References

Thu, 25 Jun 2026 02:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-821
CWE-824

Thu, 25 Jun 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-367
References
Metrics threat_severity

None

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate


Wed, 24 Jun 2026 15:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-821
CWE-824

Wed, 24 Jun 2026 07:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ipc/shm: serialize orphan cleanup with shm_nattch updates shm_destroy_orphaned() walks the shm idr under shm_ids(ns).rwsem, but that does not serialize all fields tested by shm_may_destroy(). In particular, shm_nattch is updated while holding shm_perm.lock, and attach paths can do that without holding the rwsem. Do not decide that an orphaned segment is unused before taking the object lock. Move the shm_may_destroy() check under shm_perm.lock, matching the other destroy paths, and unlock the segment when it no longer qualifies for removal.
Title ipc/shm: serialize orphan cleanup with shm_nattch updates
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-15T01:21:54.648Z

Reserved: 2026-06-09T07:44:35.369Z

Link: CVE-2026-52930

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2026-06-24T08:16:23.157

Modified: 2026-10-15T02:19:57.430

Link: CVE-2026-52930

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-06-24T00:00:00Z

Links: CVE-2026-52930 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T19:30:03Z

Weaknesses