Executive brief
A vulnerability was identified in the Linux kernel's PSP (Platform Security Processor) networking component. The issue occurs when the system fails to properly check if a security device is still active while creating a connection association. This could potentially lead to system instability or crashes if a device is removed or unregistered while the kernel is attempting to access it.
Technical details
A race condition exists in net/psp/psp_nl.c within the psp_assoc_device_get_locked() function. The function obtains a reference to a psp_dev but drops it before acquiring the device lock, creating a window where psp_dev_unregister() can complete and clear the device state. An attacker could potentially exploit this timing issue to interact with an unregistered device. The fix introduces a call to psp_dev_is_registered() after the lock is acquired to ensure the device is still valid. This affects Linux kernel versions starting from the introduction of PSP socket security associations (commit 6b46ca260e22) and is patched in stable releases 6.18.33, 7.0.10, and 7.1.
Affected products
- Linux Linux Kernel 6.18 to 6.18.33, 7.0 to 7.0.10
Timeline
- 2026-04-27: disclosed: Initial patch submitted by Jakub Kicinski
- 2026-06-24: advisory: CVE-2026-52979 published in NVD