CVE-2026-52979
Received Received - Intake
Race Condition in Linux Kernel PSP Device Association

Publication date: 2026-06-24

Last updated on: 2026-06-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: psp: check for device unregister when creating assoc psp_assoc_device_get_locked() obtains a psp_dev reference via psp_dev_get_for_sock() (which uses psp_dev_tryget() under RCU); it then acquires psd->lock and drops the reference. Before the lock is taken, psp_dev_unregister() can run to completion: take psd->lock, clear out state, unlock, drop the registration reference. The expectation is that the lock prevents device unregistration, but much like with netdevs special care has to be taken when "upgrading" a reference to a locked device. Add the missing check if device is still alive. psp_dev_is_registered() exists already but had no callers, which makes me wonder if I either forgot to add this or lost the check during refactoring...
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-24
Last Modified
2026-06-24
Generated
2026-06-25
AI Q&A
2026-06-24
EPSS Evaluated
N/A
NVD
CVE-2026-52979
EUVD
EUVD-2026-38847
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel *
linux_kernel linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's PSP (Platform Security Processor) networking code. The issue arises because when obtaining a reference to a PSP device, the code does not properly check if the device has been unregistered before acquiring a lock. Specifically, the function psp_assoc_device_get_locked() gets a reference to a device, then acquires a lock, but in the meantime, the device could have been unregistered and its state cleared. The missing check to confirm if the device is still registered before proceeding can lead to unexpected behavior or errors.

Impact Analysis

Because the code does not verify if the device is still registered before using it, this can lead to race conditions or use-after-free scenarios. Such issues may cause system instability, crashes, or potentially allow attackers to exploit the inconsistent state of the device reference. This could impact the reliability and security of systems running the affected Linux kernel versions.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52979. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart