CVE-2026-99116

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99116", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.392Z", "datePublished": "2026-10-28T10:34:33.109Z", "dateUpdated": "2026-10-31T12:43:13.361Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-31T12:43:13.361Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: psp: do not inherit the Rx association on clone\n\nsk->psp_assoc sits past sk_dontcopy_end, so sock_copy() copies it into\nevery socket accepted from a listener without taking a reference, while\ninet_sock_destruct() puts for every inet socket. psp_twsk_init() does\nrefcount_inc() for the timewait socket, so a child closing through\nTIME_WAIT cancels its own put and leaves the association with one\nreference and N timewait sockets holding the same pointer. Closing the\nlistener frees it, and the timewait timers then put freed memory.\n\nRejecting the association on a listening socket is not sufficient: a socket\ncan acquire one while established and then be turned back into a listener,\nbecause tcp_disconnect() leaves sk->psp_assoc in place.\n\n BUG: KASAN: slab-use-after-free in psp_twsk_assoc_free+0x6f/0xf0\n Write of size 4 at addr ffff888110f9255c by task swapper/7/0\n psp_twsk_assoc_free+0x6f/0xf0\n inet_twsk_put+0xda/0x1b0\n call_timer_fn+0x53/0x2e0\n __run_timers+0x764/0xa80\n Freed by task 99:\n kfree+0x1a7/0x500\n process_one_work+0x7ec/0x1100\n\nAn association carries a per-connection SPI and key, so a child must not\ninherit the parent's. Clear it on clone."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - A local process uses PSP_CMD_RX_ASSOC to reach psp_nl_rx_assoc_doit()->psp_sock_assoc_set_rx() on its listener, then completes a loopback handshake through tcp_check_req()->tcp_v4_syn_recv_sock()->tcp_create_openreq_child()->inet_csk_clone_lock()->sk_clone(). No remote message can install the listener's psp_assoc.\nAC:L - The same process controls both endpoints: it closes accepted children through tcp_fin()->tcp_time_wait()->psp_twsk_init(), closes the listener, and waits for the TIME_WAIT timer. This deterministic sequence requires no race or condition outside its control.\nPR:L - PSP_CMD_RX_ASSOC lacks GENL_ADMIN_PERM; psp_assoc_device_get_locked() only applies sockfd_lookup() to the caller's TCP fd, while psp_dev_check_access() checks network-namespace visibility rather than capabilities. An ordinary user in the device's netns suffices.\nUI:N - The attacker performs PSP association, loopback connection, child teardown, and listener closure using their own descriptors; no victim must perform any action.\nS:U - The stale pointer from sk_clone() corrupts host-kernel heap memory in psp_twsk_assoc_free(); it crosses no VM, IOMMU, or other security-authority boundary.\nC:H - The delayed psp_assoc_put() operates on reclaimed psp_assoc storage; a replacement with refcnt equal to 1 causes call_rcu() and workqueue processing on that replacement. This exploitable lifetime confusion can provide kernel execution and arbitrary kernel-memory reads.\nI:H - psp_twsk_assoc_free()->psp_assoc_put() decrements four bytes at the freed psp_assoc.refcnt; if it reaches zero, call_rcu(&pas->rcu, ...) and subsequent work initialization also modify reclaimed storage, providing exploitable heap corruption and control-flow potential.\nA:H - The demonstrated TIME_WAIT timer path produces a slab-use-after-free in psp_twsk_assoc_free(); repeated stale timers can corrupt reclaimed objects and cause a kernel oops or panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/sock.c"], "versions": [{"version": "6b46ca260e2290e3453d1355ab5b6d283d73d780", "lessThan": "a9f14ea73e82db743f0acf4219f499d594589288", "status": "affected", "versionType": "git"}, {"version": "6b46ca260e2290e3453d1355ab5b6d283d73d780", "lessThan": "c962695467d3ab9738a6508279827ec33a7d2bdf", "status": "affected", "versionType": "git"}, {"version": "6b46ca260e2290e3453d1355ab5b6d283d73d780", "lessThan": "1d2929d0850fff683b8aff051275945e65f082c8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/sock.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a9f14ea73e82db743f0acf4219f499d594589288"}, {"url": "https://git.kernel.org/stable/c/c962695467d3ab9738a6508279827ec33a7d2bdf"}, {"url": "https://git.kernel.org/stable/c/1d2929d0850fff683b8aff051275945e65f082c8"}], "title": "net: psp: do not inherit the Rx association on clone", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/core/sock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a9f14ea73e82db743f0acf4219f499d594589288", "status": "affected", "version": "6b46ca260e2290e3453d1355ab5b6d283d73d780", "versionType": "git"}, {"lessThan": "c962695467d3ab9738a6508279827ec33a7d2bdf", "status": "affected", "version": "6b46ca260e2290e3453d1355ab5b6d283d73d780", "versionType": "git"}, {"lessThan": "1d2929d0850fff683b8aff051275945e65f082c8", "status": "affected", "version": "6b46ca260e2290e3453d1355ab5b6d283d73d780", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/core/sock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: psp: do not inherit the Rx association on clone\n\nsk->psp_assoc sits past sk_dontcopy_end, so sock_copy() copies it into\nevery socket accepted from a listener without taking a reference, while\ninet_sock_destruct() puts for every inet socket. psp_twsk_init() does\nrefcount_inc() for the timewait socket, so a child closing through\nTIME_WAIT cancels its own put and leaves the association with one\nreference and N timewait sockets holding the same pointer. Closing the\nlistener frees it, and the timewait timers then put freed memory.\n\nRejecting the association on a listening socket is not sufficient: a socket\ncan acquire one while established and then be turned back into a listener,\nbecause tcp_disconnect() leaves sk->psp_assoc in place.\n\n BUG: KASAN: slab-use-after-free in psp_twsk_assoc_free+0x6f/0xf0\n Write of size 4 at addr ffff888110f9255c by task swapper/7/0\n psp_twsk_assoc_free+0x6f/0xf0\n inet_twsk_put+0xda/0x1b0\n call_timer_fn+0x53/0x2e0\n __run_timers+0x764/0xa80\n Freed by task 99:\n kfree+0x1a7/0x500\n process_one_work+0x7ec/0x1100\n\nAn association carries a per-connection SPI and key, so a child must not\ninherit the parent's. Clear it on clone."}], "id": "CVE-2026-99116", "lastModified": "2026-10-31T13:17:56.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-28T11:17:31.140", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1d2929d0850fff683b8aff051275945e65f082c8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a9f14ea73e82db743f0acf4219f499d594589288"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c962695467d3ab9738a6508279827ec33a7d2bdf"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: psp: do not inherit the Rx association on clone", "id": "2562747", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562747"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: psp: do not inherit the Rx association on clone\nsk->psp_assoc sits past sk_dontcopy_end, so sock_copy() copies it into\nevery socket accepted from a listener without taking a reference, while\ninet_sock_destruct() puts for every inet socket. psp_twsk_init() does\nrefcount_inc() for the timewait socket, so a child closing through\nTIME_WAIT cancels its own put and leaves the association with one\nreference and N timewait sockets holding the same pointer. Closing the\nlistener frees it, and the timewait timers then put freed memory.\nRejecting the association on a listening socket is not sufficient: a socket\ncan acquire one while established and then be turned back into a listener,\nbecause tcp_disconnect() leaves sk->psp_assoc in place.\nBUG: KASAN: slab-use-after-free in psp_twsk_assoc_free+0x6f/0xf0\nWrite of size 4 at addr ffff888110f9255c by task swapper/7/0\npsp_twsk_assoc_free+0x6f/0xf0\ninet_twsk_put+0xda/0x1b0\ncall_timer_fn+0x53/0x2e0\n__run_timers+0x764/0xa80\nFreed by task 99:\nkfree+0x1a7/0x500\nprocess_one_work+0x7ec/0x1100\nAn association carries a per-connection SPI and key, so a child must not\ninherit the parent's. Clear it on clone.", "A flaw was found in the Linux kernel. A local user could trigger a use-after-free vulnerability in the networking subsystem, leading to a Denial of Service (DoS) or potential privilege escalation. When network sockets are cloned, the Packet Security Protocol (PSP) association is copied from the parent socket without properly incrementing its reference counter. As a result, closing the parent and child sockets can leave lingering timers that access previously freed memory, causing the system to crash."], "name": "CVE-2026-99116", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99116\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99116\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99116.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6b46ca260e2290e3453d1355ab5b6d283d73d780,a9f14ea73e82db743f0acf4219f499d594589288)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6b46ca260e2290e3453d1355ab5b6d283d73d780,c962695467d3ab9738a6508279827ec33a7d2bdf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6b46ca260e2290e3453d1355ab5b6d283d73d780,1d2929d0850fff683b8aff051275945e65f082c8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6b46ca260e2290e3453d1355ab5b6d283d73d780,a9f14ea73e82db743f0acf4219f499d594589288)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6b46ca260e2290e3453d1355ab5b6d283d73d780,c962695467d3ab9738a6508279827ec33a7d2bdf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6b46ca260e2290e3453d1355ab5b6d283d73d780,1d2929d0850fff683b8aff051275945e65f082c8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T12:45:16.182488+00:00", "updated": "2026-10-31T15:30:15.277191+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}