{"id":"CVE-2026-99116","kind":"vulnerability","aliases":["CVE-2026-99116"],"related":[],"title":"Linux kernel PSP: use-after-free when accepted sockets inherit Rx association","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: psp: do not inherit the Rx association on clone\n\nsk->psp_assoc sits past sk_dontcopy_end, so sock_copy() copies it into\nevery socket accepted from a listener without taking a reference, while\ninet_sock_destruct() puts for every inet socket. psp_twsk_init() does\nrefcount_inc() for the timewait socket, so a child closing through\nTIME_WAIT cancels its own put and leaves the association with one\nreference and N timewait sockets holding the same pointer. Closing the\nlistener frees it, and the timewait timers then put freed memory.\n\nRejecting the association on a listening socket is not sufficient: a socket\ncan acquire one while established and then be turned back into a listener,\nbecause tcp_disconnect() leaves sk->psp_assoc in place.\n\n  BUG: KASAN: slab-use-after-free in psp_twsk_assoc_free+0x6f/0xf0\n  Write of size 4 at addr ffff888110f9255c by task swapper/7/0\n   psp_twsk_assoc_free+0x6f/0xf0\n   inet_twsk_put+0xda/0x1b0\n   call_timer_fn+0x53/0x2e0\n   __run_timers+0x764/0xa80\n  Freed by task 99:\n   kfree+0x1a7/0x500\n   process_one_work+0x7ec/0x1100\n\nAn association carries a per-connection SPI and key, so a child must not\ninherit the parent's. Clear it on clone.","summary":"In the Linux kernel's PSP networking code, child sockets accepted from a listener copy the parent's Rx association pointer without taking a reference, so closing the listener frees memory that TIME_WAIT sockets still use. The sources describe a KASAN use-after-free, which can lead to memory corruption while kernel timers run.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","networking","package","psp"],"not_affected_if":["psp-unused"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel release listed in the kernel advisory (unknown in these sources).\n- Check whether PSP is in use with `unknown` (the sources do not give a command or setting).","fix":"- Update the Linux kernel to a release that includes the upstream commit clearing the PSP association on clone (fixed version: unknown in these sources).","status":"open","published_at":"2026-10-28T11:17:31+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","triaged_at":"2026-10-28T11:37:39+00:00","updated_at":"2026-10-28T11:37:39+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-28T11:37:39Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit clearing the PSP association on clone (fixed version: unknown in these sources).","reach":"unknown","title":"Linux kernel PSP: use-after-free when accepted sockets inherit Rx association","impact":"high","summary":"In the Linux kernel's PSP networking code, child sockets accepted from a listener copy the parent's Rx association pointer without taking a reference, so closing the listener frees memory that TIME_WAIT sockets still use. The sources describe a KASAN use-after-free, which can lead to memory corruption while kernel timers run.","category":"package","nicknames":[],"who_cares":["linux-kernel","networking","psp"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory corruption via use-after-free in timer callbacks","analyst_note":"Find the fixed kernel versions and the PSP config option from the NVD entry or the kernel stable commit referenced there.","how_to_check":"- Run `uname -r` and compare against the fixed kernel release listed in the kernel advisory (unknown in these sources).\n- Check whether PSP is in use with `unknown` (the sources do not give a command or setting).","needs_analyst":true,"not_affected_if":["psp-unused"],"who_is_affected":"Kernel builds with PSP support where a listening socket has a PSP association, including sockets that were established with one and later turned back into listeners via tcp_disconnect(). Systems that do not use PSP are unlikely to be exposed, but the sources do not state the exact config option that enables it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000665,"input_tokens":3726,"output_tokens":585,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':230C,246C,251C,256C,260C,267C,272C '-2026':15A,18A '-99116':16A,19A '4':235C '99':265C 'accept':9A,36B,118C 'acquir':197C 'addr':237C 'assoc':104C,215C,228C,244C 'associ':13A,45B,99C,159C,186C,275C 'back':205C 'bug':218C 'call':253C 'cancel':152C 'carri':276C 'child':34B,147C,286C 'clear':293C 'clone':101C,296C 'close':52B,148C,171C 'code':33B 'connect':280C 'copi':40B,112C,113C 'corrupt':77B 'cve':14A,17A 'describ':65B 'destruct':129C 'disconnect':211C 'dontcopi':108C 'end':109C 'establish':200C 'everi':116C,132C 'ffff888110f9255c':238C 'fn':255C 'follow':87C 'free':7A,55B,71B,174C,224C,229C,245C 'freed':182C,262C 'hold':167C 'inc':140C 'inet':127C,133C,248C 'inherit':11A,96C,289C 'init':137C 'kasan':67B,219C 'kernel':2A,22B,29B,79B,85C 'key':283C 'kfree':266C 'lead':74B 'leav':157C,212C 'linux':1A,21B,28B,84C 'linux-kernel':20B 'listen':39B,54B,121C,173C,189C,208C 'memori':56B,76B,183C 'must':287C 'n':164C 'net':92C 'network':23B,32B 'one':161C,198C,270C 'packag':24B 'parent':42B,291C 'past':106C 'per':279C 'per-connect':278C 'place':217C 'pointer':46B,170C 'process':269C 'psp':3A,25B,31B,93C,103C,135C,214C,226C,242C 'put':130C,155C,181C,250C 'refcount':139C 'refer':50B,125C,162C 'reject':184C 'resolv':91C 'run':81B,258C 'rx':12A,44B,98C 'sit':105C 'size':234C 'sk':102C,107C,213C 'slab':221C 'slab-use-after-fre':220C 'sock':111C,128C 'socket':10A,35B,60B,117C,134C,144C,166C,190C,195C 'sourc':64B 'spi':281C 'still':61B 'suffici':193C 'swapper/7/0':241C 'take':48B,123C 'task':240C,264C 'tcp':210C 'time':58B,150C 'timer':80B,179C,254C,259C 'timewait':143C,165C,178C 'turn':204C 'twsk':136C,227C,243C,249C 'use':5A,62B,69B,222C 'use-after-fre':4A,68B 'vulner':88C 'wait':59B,151C 'without':47B,122C 'work':271C 'write':232C 'x1a7/0x500':268C 'x53/0x2e0':257C 'x6f/0xf0':231C,247C 'x764/0xa80':261C 'x7ec/0x1100':273C 'xda/0x1b0':252C","nicknames":[],"mitigations":[],"who_affected":"Kernel builds with PSP support where a listening socket has a PSP association, including sockets that were established with one and later turned back into listeners via tcp_disconnect(). Systems that do not use PSP are unlikely to be exposed, but the sources do not state the exact config option that enables it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99116","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99116","severity":null,"published_at":"2026-10-28T11:17:31+00:00","modified_at":"2026-10-28T11:17:31+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","fetched_at":"2026-10-28T11:32:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}