Executive brief
A race condition was identified in the Linux kernel's shared memory (SHM) subsystem. This component allows different programs to share the same memory space for faster data exchange. Under specific conditions, the system might incorrectly clean up a memory segment that is still in use, potentially leading to system instability or crashes.
Technical details
A race condition exists in ipc/shm.c within the Linux kernel. The function shm_destroy_orphaned() iterates through shared memory identifiers using the namespace rwsem, but it fails to properly synchronize with shm_nattch (attachment count) updates which occur under shm_perm.lock. Because attach paths can update the attachment count without holding the rwsem, shm_may_destroy() could return true prematurely. This allows a shared memory segment to be destroyed while a concurrent process is attempting to attach to it. The fix moves the shm_may_destroy() check inside the shm_perm.lock critical section to ensure atomic evaluation of the segment's state.
Affected products
- Linux Linux 3.1 to 5.10.259, 5.15.210, and other stable branches
Timeline
- 2026-04-30: other: Vulnerability fix authored
- 2026-06-03: other: Patch committed to maintainer tree
- 2026-06-24: disclosed: CVE published and patched in stable branches
References
- https://git.kernel.org/stable/c/030bbc857bd51d4b25a90d931d3f8775ef22823a
- https://git.kernel.org/stable/c/1f0d01e35dbb228084d5187212e32c91a30dcbeb
- https://git.kernel.org/stable/c/2e5c6f4fd4001562781e99bbfc7f1f0127187542
- https://git.kernel.org/stable/c/6560be3f6a5bb84f006f184f0c966747bb58e1a3
- https://git.kernel.org/stable/c/92cda2593cf2ed25b0e9d78e5e6d8303bba1a064
- https://git.kernel.org/stable/c/b1e9aef48e4d8a0c1b54fb913077b0824ed7d650
- https://git.kernel.org/stable/c/b5107b4ce3ad45fcf369ee2058c8910620f4b5a8