CVE-2026-98274: net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()
In the Linux kernel, the following vulnerability has been resolved:
net: psp: avoid conflicts with skb->decrypted and skvalidatexmitskb()
PSP conflicts with TLS ULP in its usage of both skb->decrypted and sk->skvalidatexmitskb().
Make PSP mutually exclusive with TLS ULP, the only other user of either of these. As other users of skb->decrypted come along, they can be added to skhasdecryptuser(). It would make sense to also assert that sk->skvalidatexmitskb() is also NULL in both of these setup paths for similar future proofing, but the PSP listener/skclone() path is still broken and it could be seen as a regression to not allow rx assoc to run on a child of a listener socket with PSP tx assoc state.
Include all TCP ULPs in the skhasdecryptuser() check, even though TLS is the only one that conflicts with PSP via the decrypted bit. This is intentional because PSP was not designed to be used with ULPs. It is best to close off surface area that may make bugs reachable, until someone wishes to design and test an actual user of PSP with ULPs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not use PSP with TCP ULPs, including TLS ULP; PSP was not designed to be used with ULPs.
Linux kernel PSP and TCP ULPs PSP with TCP ULP = mutually exclusive
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel systems using PSP are the relevant population. The conflict is specifically with TCP ULPs, including TLS ULP; PSP was not designed to be used with ULPs.
What configuration causes the conflict?
The issue becomes reachable when PSP is used together with a TCP ULP on the same socket context. Both PSP and TLS ULP use skb->decrypted and sk->sk_validate_xmit_skb(), creating the conflict.
What mitigation is available if an update cannot be applied immediately?
Avoid combining PSP with any TCP ULP, particularly TLS ULP. The resolved change makes PSP mutually exclusive with TCP ULPs to prevent this unsupported combination.