Race Condition in Linux Kernel PSP Device Association

Publication date: 2026-06-24

Last updated on: 2026-07-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: psp: check for device unregister when creating assoc psp_assoc_device_get_locked() obtains a psp_dev reference via psp_dev_get_for_sock() (which uses psp_dev_tryget() under RCU); it then acquires psd->lock and drops the reference. Before the lock is taken, psp_dev_unregister() can run to completion: take psd->lock, clear out state, unlock, drop the registration reference. The expectation is that the lock prevents device unregistration, but much like with netdevs special care has to be taken when "upgrading" a reference to a locked device. Add the missing check if device is still alive. psp_dev_is_registered() exists already but had no callers, which makes me wonder if I either forgot to add this or lost the check during refactoring...

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-14

Generated

2026-07-15

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-52979

EUVD

EUVD-2026-38847

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 6.18 (inc) to 6.18.33 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-667	The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's PSP (Platform Security Processor) networking code. The issue arises because when obtaining a reference to a PSP device, the code does not properly check if the device has been unregistered before acquiring a lock. Specifically, the function psp_assoc_device_get_locked() gets a reference to a device, then acquires a lock, but in the meantime, the device could have been unregistered and its state cleared. The missing check to confirm if the device is still registered before proceeding can lead to unexpected behavior or errors.

Impact Analysis

Because the code does not verify if the device is still registered before using it, this can lead to race conditions or use-after-free scenarios. Such issues may cause system instability, crashes, or potentially allow attackers to exploit the inconsistent state of the device reference. This could impact the reliability and security of systems running the affected Linux kernel versions.

Hi! I’m here to help you understand CVE-2026-52979. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70