---
title: "CVE-2026-52923 — An overflowing IPC identifier could point at the wrong object"
description: "CVE-2026-52923: Linux could allocate a System V IPC number just beyond the range its identifier format can represent. The oversized index spilled into the sequence portion of the ID, so the number returned to userspace no longer reliably named the object that had just been created. Fixed upstream in May 2026 and backported by RHEL on August 11."
url: https://nebusec.ai/buglist/CVE-2026-52923/
published: 2026-08-24T00:00:00.000Z
---

CVE-2026-52923 · High

# An overflowing IPC identifier could point at the wrong object

Linux kernel · System V IPC · Published Aug 24, 2026

ipc_idr_alloc

* [CVSS 7.8 · CNA ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-52923)
* Fixed
* Integer-overflow
* Namespace required

Affects · Linux v3.8 until the fix · RHEL 10.2 · Linux 6.12.0-211.7.3.el10_2 demo target

[View exploit→](#exploit)

Artifacts · [exploit.md](#exploit) · [patch.diff](#patch)

## Summary

Linux could allocate a System V IPC number just beyond the range its identifier format can represent. The oversized index spilled into the sequence portion of the ID, so the number returned to userspace no longer reliably named the object that had just been created.

The flaw was introduced in January 2013. It was fixed upstream in May 2026 and backported to RHEL on August 11, before this public demonstration.

## Why it mattered

A local user permitted to choose the next message-queue, semaphore, or shared-memory ID could create objects that became unreachable or, after reuse, resolve to a different object. That breaks the identifier checks used to separate IPC objects.

The affected code has been fixed. The risk described here applies to unpatched kernels in the affected line, not automatically to every system using the named distribution today.

## What went wrong

`ipc_idr_alloc()` used an unbounded `idr_alloc()` request for checkpoint-and-restore IDs. When the remaining representable slots were occupied, the allocator could return the first index outside the valid IPC index field.

## Exploit

Because the issue and its fixes are public, NebuSec’s validation code is included here for reproducibility. The preview starts at the program entry point and shows exactly 15 lines. Expanding it reveals the complete selected C file embedded in this page; build files, headers, helpers, and any additional sources remain in the linked CyberMeowfia directory.

Public exploit · patched target

CyberMeowfia snapshot4c1f0aa

[Browse all files](https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52923-RHEL-6.12.0-211.7.3.el10_2)

Exploit entry point · 1053 lines · [Open at main() ↗](https://github.com/NebuSec/CyberMeowfia/blob/4c1f0aaaf1b981e74c47f24d88ebdf6ad51c9586/security-research/Linux-CVE-2026-52923-RHEL-6.12.0-211.7.3.el10_2/exploit.c#L997)

```c
int main(int argc, char **argv)
{
  setvbuf(stdout, NULL, _IONBF, 0);
  if (argc == 2 && !strcmp(argv[1], "--vuln-trigger"))
    return run_vuln_trigger();
  if (argc == 2)
    return root_helper(argv[1]);
  if (argc != 1) {
    fprintf(stderr, "usage: %s [--vuln-trigger]\n", argv[0]);
    return EXIT_FAILURE;
  }
  drop_to_nobody_if_root();
  prepare_regular_helper();
  if (!fork())
    watch_payload_ready();
```

The selected file is the execution entry point. Build files, headers, leak helpers, and supporting sources remain in the linked CyberMeowfia directory.

## Patch

**Fixed upstream in May 2026 and backported by RHEL on August 11.** The fix bounds allocation to the range the IPC identifier can encode. Update to the vendor kernel containing the backport; on the demonstrated RHEL line, builds incorporating the August 11 correction are the relevant boundary.

The safest check is the distribution’s own kernel changelog for `CVE-2026-52923`; version numbers alone can be misleading because vendors routinely backport security fixes without changing to the newest upstream kernel.

Find bugs in your code.

Before anyone else does.

[Book a demo](https://nebusec.ai/book-a-demo/)