Executive brief
A vulnerability in the Linux kernel's PSP (Platform Security Processor) networking component could allow a local user to modify sensitive device settings. Specifically, users without administrative privileges could change device configurations and rotate cryptographic keys, which are actions normally reserved for system administrators. This could lead to unauthorized changes in security settings or disruption of encrypted communications.
Technical details
A vulnerability exists in the Linux kernel's net/psp component where the 'dev-set' and 'key-rotate' Netlink operations do not require CAP_NET_ADMIN privileges. The root cause is that the psp_dev_check_access() function only verifies network namespace (netns) membership rather than administrative capabilities. A local attacker with access to the network namespace could exploit this to modify shared device state, including PSP version configurations and cryptographic key material. The issue has been resolved by adding the GENL_ADMIN_PERM flag to the affected Netlink operations in the psp-nl-gen.c file and updating the Netlink specifications.
Affected products
- Linux Linux Kernel 6.18 to 6.18.33, 7.0 to 7.0.10
Timeline
- 2026-04-27: other: Initial patch authored
- 2026-06-24: disclosed: CVE published