Live › vulnerability › CVE-2026-99116
Go to dashboardIn the Linux kernel's PSP networking code, child sockets accepted from a listener copy the parent's Rx association pointer without taking a reference, so closing the listener frees memory that TIME_WAIT sockets still use. The sources describe a KASAN use-after-free, which can lead to memory corruption while kernel timers run.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Kernel builds with PSP support where a listening socket has a PSP association, including sockets that were established with one and later turned back into listeners via tcp_disconnect(). Systems that do not use PSP are unlikely to be exposed, but the sources do not state the exact config option that enables it.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel release listed in the kernel advisory (unknown in these sources).unknown (the sources do not give a command or setting).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: psp: do not inherit the Rx association on clone
sk->psp_assoc sits past sk_dontcopy_end, so sock_copy() copies it into every socket accepted from a listener without taking a reference, while inet_sock_destruct() puts for every inet socket. psp_twsk_init() does refcount_inc() for the timewait socket, so a child closing through TIME_WAIT cancels its own put and leaves the association with one reference and N timewait sockets holding the same pointer. Closing the listener frees it, and the timewait timers then put freed memory.
Rejecting the association on a listening socket is not sufficient: a socket can acquire one while established and then be turned back into a listener, because tcp_disconnect() leaves sk->psp_assoc in place.
BUG: KASAN: slab-use-after-free in psp_twsk_assoc_free+0x6f/0xf0 Write of size 4 at addr ffff888110f9255c by task swapper/7/0 psp_twsk_assoc_free+0x6f/0xf0 inet_twsk_put+0xda/0x1b0 call_timer_fn+0x53/0x2e0 __run_timers+0x764/0xa80 Freed by task 99: kfree+0x1a7/0x500 process_one_work+0x7ec/0x1100
An association carries a per-connection SPI and key, so a child must not inherit the parent's. Clear it on clone.
This page as .md · .json · in your agent: get_signal("CVE-2026-99116")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.