CVE-2026-98274

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb() PSP conflicts with TLS ULP in its usage of both skb->decrypted and sk->sk_validate_xmit_skb(). Make PSP mutually exclusive with TLS ULP, the only other user of either of these. As other users of skb->decrypted come along, they can be added to sk_has_decrypt_user(). It would make sense to also assert that sk->sk_validate_xmit_skb() is also NULL in both of these setup paths for similar future proofing, but the PSP listener/sk_clone() path is still broken and it could be seen as a regression to not allow rx assoc to run on a child of a listener socket with PSP tx assoc state. Include all TCP ULPs in the sk_has_decrypt_user() check, even though TLS is the only one that conflicts with PSP via the decrypted bit. This is intentional because PSP was not designed to be used with ULPs. It is best to close off surface area that may make bugs reachable, until someone wishes to design and test an actual user of PSP with ULPs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98274

EUVD

EUVD-2026-93202

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	6b46ca260e2290e3453d1355ab5b6d283d73d780
Linux	Linux	6b46ca260e2290e3453d1355ab5b6d283d73d780
Linux	Linux	6b46ca260e2290e3453d1355ab5b6d283d73d780
Linux	Linux	6.18

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a conflict between the Platform Security Processor (PSP) and Transport Layer Security (TLS) Upper Layer Protocol (ULP). The issue arises because both PSP and TLS ULP use the same kernel features, specifically skb->decrypted and sk->sk_validate_xmit_skb(), which can lead to unexpected behavior or security issues.

Detection Guidance

This vulnerability is specific to the Linux kernel's PSP (Platform Security Processor) and TLS ULP (Upper Layer Protocol) interaction. Detection requires checking kernel configurations and running specific commands to identify conflicts between PSP and TLS ULP usage.

Impact Analysis

This vulnerability could impact systems using both PSP and TLS ULP, potentially causing network packet handling issues, security bypasses, or system instability. Systems relying on TLS for secure communications might experience disruptions or incorrect decryption handling.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel networking issue involving PSP and TLS ULP conflicts. No evidence suggests data privacy or security compliance impacts from this specific vulnerability.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version where PSP and TLS ULP conflicts are resolved. Ensure PSP is mutually exclusive with TLS ULP by checking kernel configurations and disabling conflicting modules if necessary.

Hi! I’m here to help you understand CVE-2026-98274. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70