CVE-2026-93824

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93824", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-18T17:59:28.792Z", "datePublished": "2026-09-24T16:03:02.783Z", "dateUpdated": "2026-10-03T10:57:55.753Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-03T10:57:55.753Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: reject the combination of TLS and sockmap\n\nTLS and sockmap (BPF psock) integration hides a lot of latent bugs.\nBugs which may be more or less relevant for real users but they\nare definitely exploitable.\n\nWe could not find anyone actively using this integration so let's\nreject this config. Adding a TLS socket to a sockmap was already\nrejected by sk_psock_init() through the inet_csk_has_ulp() check.\nWe need to reject the attempts to configure the TLS keys (rather\nthan adding the ULP itself) because checking prior to the ULP\ninstallation is tricky without risking a race with sockmap getting\nadded in parallel (sockmap does not hold the socket lock).\n\nThis patch is a minimal rejection of the feature. Subsequent patch\nin the series will do a light dead code removal. Full cleanup would\nrequire a major rewrite of the Tx path, we don't need skmsg any more."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tls/tls_main.c"], "versions": [{"version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca", "lessThan": "c4896592744f30ff026f799947c5978bcfd7c8c7", "status": "affected", "versionType": "git"}, {"version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca", "lessThan": "e26aa709454d48c3b3ef8d3100c8a04e7d9fd94e", "status": "affected", "versionType": "git"}, {"version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca", "lessThan": "c3d4d537337f69e405a36fa561e7292ee4148bf7", "status": "affected", "versionType": "git"}, {"version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca", "lessThan": "a08e780b6cc1153cbff8be55de9ec9da809e344f", "status": "affected", "versionType": "git"}, {"version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca", "lessThan": "460e6486617c17dd19abe8f3fc67d9a6fa25f8ca", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tls/tls_main.c"], "versions": [{"version": "4.20", "status": "affected"}, {"version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c4896592744f30ff026f799947c5978bcfd7c8c7"}, {"url": "https://git.kernel.org/stable/c/e26aa709454d48c3b3ef8d3100c8a04e7d9fd94e"}, {"url": "https://git.kernel.org/stable/c/c3d4d537337f69e405a36fa561e7292ee4148bf7"}, {"url": "https://git.kernel.org/stable/c/a08e780b6cc1153cbff8be55de9ec9da809e344f"}, {"url": "https://git.kernel.org/stable/c/460e6486617c17dd19abe8f3fc67d9a6fa25f8ca"}], "title": "tls: reject the combination of TLS and sockmap", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/tls/tls_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c4896592744f30ff026f799947c5978bcfd7c8c7", "status": "affected", "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca", "versionType": "git"}, {"lessThan": "e26aa709454d48c3b3ef8d3100c8a04e7d9fd94e", "status": "affected", "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca", "versionType": "git"}, {"lessThan": "c3d4d537337f69e405a36fa561e7292ee4148bf7", "status": "affected", "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca", "versionType": "git"}, {"lessThan": "a08e780b6cc1153cbff8be55de9ec9da809e344f", "status": "affected", "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca", "versionType": "git"}, {"lessThan": "460e6486617c17dd19abe8f3fc67d9a6fa25f8ca", "status": "affected", "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/tls/tls_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"lessThan": "4.20", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: reject the combination of TLS and sockmap\n\nTLS and sockmap (BPF psock) integration hides a lot of latent bugs.\nBugs which may be more or less relevant for real users but they\nare definitely exploitable.\n\nWe could not find anyone actively using this integration so let's\nreject this config. Adding a TLS socket to a sockmap was already\nrejected by sk_psock_init() through the inet_csk_has_ulp() check.\nWe need to reject the attempts to configure the TLS keys (rather\nthan adding the ULP itself) because checking prior to the ULP\ninstallation is tricky without risking a race with sockmap getting\nadded in parallel (sockmap does not hold the socket lock).\n\nThis patch is a minimal rejection of the feature. Subsequent patch\nin the series will do a light dead code removal. Full cleanup would\nrequire a major rewrite of the Tx path, we don't need skmsg any more."}], "id": "CVE-2026-93824", "lastModified": "2026-10-03T11:17:52.223", "metrics": {}, "published": "2026-09-24T17:17:16.073", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/460e6486617c17dd19abe8f3fc67d9a6fa25f8ca"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a08e780b6cc1153cbff8be55de9ec9da809e344f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c3d4d537337f69e405a36fa561e7292ee4148bf7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c4896592744f30ff026f799947c5978bcfd7c8c7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e26aa709454d48c3b3ef8d3100c8a04e7d9fd94e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: tls: reject the combination of TLS and sockmap", "id": "2540522", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540522"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-413", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntls: reject the combination of TLS and sockmap\nTLS and sockmap (BPF psock) integration hides a lot of latent bugs.\nBugs which may be more or less relevant for real users but they\nare definitely exploitable.\nWe could not find anyone actively using this integration so let's\nreject this config. Adding a TLS socket to a sockmap was already\nrejected by sk_psock_init() through the inet_csk_has_ulp() check.\nWe need to reject the attempts to configure the TLS keys (rather\nthan adding the ULP itself) because checking prior to the ULP\ninstallation is tricky without risking a race with sockmap getting\nadded in parallel (sockmap does not hold the socket lock).\nThis patch is a minimal rejection of the feature. Subsequent patch\nin the series will do a light dead code removal. Full cleanup would\nrequire a major rewrite of the Tx path, we don't need skmsg any more.", "A flaw was found in the Linux kernel's Transport Layer Security (TLS) subsystem. A local user can trigger this vulnerability by configuring TLS keys on a network socket already attached to a Berkeley Packet Filter (BPF) socket map (sockmap). This unsupported integration exposes latent flaws in the networking stack, potentially resulting in memory corruption and a denial of service (DoS)."], "name": "CVE-2026-93824", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93824\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93824\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93824.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c3d4d537337f69e405a36fa561e7292ee4148bf7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a08e780b6cc1153cbff8be55de9ec9da809e344f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,460e6486617c17dd19abe8f3fc67d9a6fa25f8ca)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-24T21:30:17.071773+00:00", "updated": "2026-10-01T21:15:09.058351+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-362", "CWE-413"]}