CVE-2026-99116: net: psp: do not inherit the Rx association on clone

Published Oct 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

net: psp: do not inherit the Rx association on clone

sk->pspassoc sits past skdontcopyend, so sockcopy() copies it into every socket accepted from a listener without taking a reference, while inetsockdestruct() puts for every inet socket. psptwskinit() does refcountinc() for the timewait socket, so a child closing through TIMEWAIT cancels its own put and leaves the association with one reference and N timewait sockets holding the same pointer. Closing the listener frees it, and the timewait timers then put freed memory.

Rejecting the association on a listening socket is not sufficient: a socket can acquire one while established and then be turned back into a listener, because tcpdisconnect() leaves sk->pspassoc in place.

BUG: KASAN: slab-use-after-free in psptwskassocfree+0x6f/0xf0 Write of size 4 at addr ffff888110f9255c by task swapper/7/0 psptwskassocfree+0x6f/0xf0 inettwskput+0xda/0x1b0 calltimerfn+0x53/0x2e0 runtimers+0x764/0xa80 Freed by task 99: kfree+0x1a7/0x500 processonework+0x7ec/0x1100

An association carries a per-connection SPI and key, so a child must not inherit the parent's. Clear it on clone.

Event History

Oct 28, 2026

CVE Published

via MITRE·10:34 AM

Data Sourced

via MITRE·10:34 AM

Description

Frequently Asked Questions

What systems are exposed to this issue?

Linux kernel systems using the PSP networking functionality are exposed when a socket with a PSP association is used as, or converted into, a listener and accepts child sockets. The issue involves accepted children inheriting the listener's association without an additional reference.

What conditions are needed to trigger the use-after-free?

A PSP association must be present on a socket that becomes a listener, then child sockets must be accepted and progress through TIME_WAIT. The listener can be closed while TIME_WAIT timers still hold the inherited association pointer, causing later timer processing to put freed memory.

Does rejecting PSP associations on listening sockets fully mitigate the issue?

No. A socket can acquire an association while established and later be turned back into a listener because tcp_disconnect() leaves sk->psp_assoc in place.

How can administrators reduce exposure before applying the fix?

Avoid using PSP-associated sockets as listeners or converting previously established PSP-associated sockets into listeners. In particular, do not rely solely on preventing associations from being configured directly on listening sockets.

CVE-2026-99116: net: psp: do not inherit the Rx association on clone

Event History

Frequently Asked Questions

What systems are exposed to this issue?

What conditions are needed to trigger the use-after-free?

Does rejecting PSP associations on listening sockets fully mitigate the issue?

How can administrators reduce exposure before applying the fix?

Company

Resources

Contact

Frequently Asked Questions

What systems are exposed to this issue?

What conditions are needed to trigger the use-after-free?

Does rejecting PSP associations on listening sockets fully mitigate the issue?

How can administrators reduce exposure before applying the fix?