Linux Kernel: Use-after-free in PSP socket association on clone
Summary
The Linux kernel's PSP (Pre-Shared Key Security Protocol) code copies a socket's Rx security association into child sockets accepted from a listener, without taking a reference. When a child socket closes through TIME_WAIT, the shared association can be freed while timewait sockets still point to it, causing a use-after-free. A local user with low privileges could potentially crash the system or run code in kernel context, though this is not confirmed. The flaw only matters on systems where PSP is configured.
Affected
- Linux kernel with PSP support (net/psp) from the introducing commit 6b46ca260e22 onward
- OSV: introduced in 6.18.0 and 6.19.0, fixed in 6.18.59 and 7.2.13
- The CVE record lists a different affected range, so verify against your kernel version
- Distribution-specific affected builds: Unknown.
Fixed in
- Upstream fix commits: 1d2929d0850fff683b8aff051275945e65f082c8, a9f14ea73e82db743f0acf4219f499d594589288, c962695467d3ab9738a6508279827ec33a7d2bdf
- Fixed stable kernel releases per OSV: 6.18.59 and 7.2.13 or later
- Fixed builds of Debian, Ubuntu, Red Hat, SUSE and other distributions: Unknown.
Workaround
- No vendor workaround known.
- Unverified inference: systems that do not use PSP (no PSP-capable NIC and no PSP configuration) are probably not affected.
Exploitation
- No known exploitation in the wild.
- No public exploit found. The commit message contains a KASAN trace that describes the bug.
- EPSS: about 0.17 %.
Our recommendation
- Inventory Linux hosts and check whether PSP (net/psp) is in use.
- Apply the distribution's kernel update as soon as it is available, with priority on multi-tenant hosts and systems with untrusted local users.
- Check the official CVE record and NVD for the final severity rating, as sources differ.
- Monitor vendor advisories for the patched kernel build.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Upstream commit 1d2929d0850fff683b8aff051275945e65f082c8 (kernel.org stable) git.kernel.org
- Stable commit a9f14ea73e82db743f0acf4219f499d594589288 git.kernel.org
- Stable commit c962695467d3ab9738a6508279827ec33a7d2bdf git.kernel.org
- Upstream commit mirror (wireguard-linux) git.zx2c4.com
- Ubuntu security tracker ubuntu.com
- OSV/BELL advisory (Alpaquita) osv.dev
- Vulners Debian CVE mirror vulners.com
- Strix CVE page www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:03.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: net: psp: do not inherit the Rx association on clone sk->psp_assoc sits past sk_dontcopy_end, so sock_copy() copies it into every socket accepted from a listener without taking a reference, while inet_sock_destruct() puts for every inet socket. psp_twsk_init() does refcount_inc() for the timewait socket, so a child closing through TIME_WAIT cancels its own put and leaves the association with one reference and N timewait sockets holding the same pointer. Closing the listener frees it, and the timewait timers then put freed memory. Rejecting the association on a listening socket is not sufficient: a socket can acquire one while established and then be turned back into a listener, because tcp_disconnect() leaves sk->psp_assoc in place. BUG: KASAN: slab-use-after-free in psp_twsk_assoc_free+0x6f/0xf0 Write of size 4 at addr ffff888110f9255c by task swapper/7/0 psp_twsk_assoc_free+0x6f/0xf0 inet_twsk_put+0xda/0x1b0 call_timer_fn+0x53/0x2e0 __run_timers+0x764/0xa80 Freed by task 99: kfree+0x1a7/0x500 process_one_work+0x7ec/0x1100 An association carries a per-connection SPI and key, so a child must not inherit the parent's. Clear it on clone.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.