[SRU][Q][PATCH 0/1] CVE-2026-52993

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-52993

[ Impact ]

A double-free flaw exists in the TIPC subsystem in tipc_buf_append().
tipc_msg_validate() can reallocate the skb it is validating, freeing the old
one, but the function was called with a pointer to a local copy of the caller's
skb pointer. If the skb was reallocated and validation subsequently failed, the
error handling path would free the already-freed original skb pointer, leading
to a double-free that can corrupt kernel memory.

[ Fix ]

questing: clean cherry-pick
focal: backported with AI-assisted adaptation
bionic: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

An incorrect fix could mishandle skb reassignment in the TIPC message
reassembly path, potentially causing memory leaks, use-after-free, or dropped
packets. Any regression would be confined to systems using the TIPC networking
protocol.