CVE-2026-52979: Linux Kernel Privilege Escalation Flaw

CVE-2026-52979 Overview

CVE-2026-52979 is a race condition in the Linux kernel networking subsystem affecting the Platform Security Protocol (PSP) association code. The flaw resides in psp_assoc_device_get_locked(), which acquires a psp_dev reference through psp_dev_get_for_sock() under RCU, then takes psd->lock and drops the reference. During the window before the lock is acquired, psp_dev_unregister() can complete and tear down device state. The function failed to verify the device remained registered after upgrading the reference, allowing operations against a freed or torn-down device.

Critical Impact
A race between PSP association creation and device unregistration can lead to use-after-free conditions or operations on an unregistered network device, potentially causing kernel instability.

Affected Products

Linux kernel branches containing the PSP networking association code prior to the referenced fix commits
Distributions shipping affected mainline or stable kernel snapshots
Systems with PSP socket protocol functionality enabled

Discovery Timeline

2026-06-24 - CVE-2026-52979 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52979

Vulnerability Analysis

The vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition [CWE-367] in the Linux kernel PSP networking layer. The function psp_assoc_device_get_locked() performs a multi-step reference handoff. It first calls psp_dev_get_for_sock(), which internally uses psp_dev_tryget() under RCU to obtain a reference to a psp_dev structure. The function then acquires psd->lock and drops the original reference, expecting the lock to protect against teardown.

This expectation is incorrect. Between the reference drop and lock acquisition, psp_dev_unregister() can execute fully: it takes psd->lock, clears device state, releases the lock, and drops the registration reference. When the original caller subsequently acquires psd->lock, the device has already been unregistered, but no check verifies its liveness.

Root Cause

The root cause is a missing liveness check after re-acquiring a lock on a refcounted kernel object. The helper psp_dev_is_registered() existed in the codebase but had no callers, indicating the registration check was either omitted during initial implementation or removed during refactoring. The pattern mirrors known requirements around netdev references, where lock acquisition does not by itself guarantee that an object has not been unregistered.

Attack Vector

Exploitation requires local access to trigger PSP association creation on a socket while a concurrent administrative action unregisters the underlying PSP device. The race window is narrow, but repeated attempts during device teardown sequences can reliably hit the unprotected interval. Successful exploitation can result in operations on torn-down state, kernel memory corruption, or denial of service through kernel crash. The vulnerability is not remotely reachable without prior local code execution capable of invoking the relevant socket operations.

No public proof-of-concept code is available. Refer to the kernel commit b89769f9, kernel commit d90df5ce, and kernel commit e201c570 for the corrective changes that add the missing psp_dev_is_registered() check.

Detection Methods for CVE-2026-52979

Indicators of Compromise

Kernel oops or panic messages referencing psp_assoc_device_get_locked, psp_dev_get_for_sock, or psp_dev_unregister in dmesg or /var/log/kern.log
KASAN use-after-free reports tied to psp_dev structures on kernels built with sanitizers enabled
Unexplained network device teardown events coinciding with socket connection attempts using PSP protection

Detection Strategies

Audit running kernel versions across the fleet and compare against the patched stable trees referenced in the kernel git commit logs
Enable kernel lockdep and KASAN in test environments to catch race conditions in PSP code paths
Correlate kernel crash dumps with workloads that exercise PSP-protected sockets near device administration events

Monitoring Recommendations

Forward kernel.crit and kernel.alert syslog facilities to a centralized log platform for crash pattern analysis
Track uname -r output across Linux endpoints to identify hosts running unpatched kernels
Alert on repeated kernel soft lockups or BUG messages originating from the net/psp/ source path

How to Mitigate CVE-2026-52979

Immediate Actions Required

Inventory Linux systems running kernels with the PSP networking feature enabled and prioritize those exposing PSP-protected sockets to untrusted local users
Apply the upstream stable kernel update containing the fix commits as soon as distribution packages become available
Restrict local user access on multi-tenant Linux hosts until kernels are updated

Patch Information

The fix adds a call to psp_dev_is_registered() after acquiring psd->lock in psp_assoc_device_get_locked(), ensuring the device has not been unregistered during the reference handoff. The corrective changes are tracked in upstream kernel commits b89769f9, d90df5ce, and e201c570. Consume kernel updates through your distribution's security channel rather than building from source where possible.

Workarounds

Disable the PSP networking module on systems that do not require PSP socket protection until the patched kernel is installed
Limit which local accounts can open PSP-protected sockets by applying tighter capability restrictions and seccomp filters on relevant workloads
Avoid administrative operations that unregister PSP devices while production workloads hold active PSP associations

bash

# Verify kernel version and check for PSP module presence
uname -r
lsmod | grep -i psp
# Apply distribution security updates (example for Debian/Ubuntu)
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-$(uname -r | sed 's/-generic//')
sudo reboot