---
id: "CVE-2026-99116"
kind: "vulnerability"
aliases: ["CVE-2026-99116"]
title: "Linux kernel PSP: use-after-free when accepted sockets inherit Rx association"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["linux-kernel", "networking", "package", "psp"]
not_affected_if: ["psp-unused"]
published_at: "2026-10-28T11:17:31+00:00"
first_seen_at: "2026-10-28T11:32:34+00:00"
updated_at: "2026-10-28T11:37:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99116", "first_seen_at": "2026-10-28T11:32:34+00:00"}]
---

# Linux kernel PSP: use-after-free when accepted sockets inherit Rx association

In the Linux kernel's PSP networking code, child sockets accepted from a listener copy the parent's Rx association pointer without taking a reference, so closing the listener frees memory that TIME_WAIT sockets still use. The sources describe a KASAN use-after-free, which can lead to memory corruption while kernel timers run.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare against the fixed kernel release listed in the kernel advisory (unknown in these sources).
- Check whether PSP is in use with `unknown` (the sources do not give a command or setting).

## Fix

- Update the Linux kernel to a release that includes the upstream commit clearing the PSP association on clone (fixed version: unknown in these sources).

## Timeline

- 2026-10-28T11:32:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99116

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

net: psp: do not inherit the Rx association on clone

sk->psp_assoc sits past sk_dontcopy_end, so sock_copy() copies it into
every socket accepted from a listener without taking a reference, while
inet_sock_destruct() puts for every inet socket. psp_twsk_init() does
refcount_inc() for the timewait socket, so a child closing through
TIME_WAIT cancels its own put and leaves the association with one
reference and N timewait sockets holding the same pointer. Closing the
listener frees it, and the timewait timers then put freed memory.

Rejecting the association on a listening socket is not sufficient: a socket
can acquire one while established and then be turned back into a listener,
because tcp_disconnect() leaves sk->psp_assoc in place.

  BUG: KASAN: slab-use-after-free in psp_twsk_assoc_free+0x6f/0xf0
  Write of size 4 at addr ffff888110f9255c by task swapper/7/0
   psp_twsk_assoc_free+0x6f/0xf0
   inet_twsk_put+0xda/0x1b0
   call_timer_fn+0x53/0x2e0
   __run_timers+0x764/0xa80
  Freed by task 99:
   kfree+0x1a7/0x500
   process_one_work+0x7ec/0x1100

An association carries a per-connection SPI and key, so a child must not
inherit the parent's. Clear it on clone.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_