CVE-2026-52978

What it actually does

This is an authorization bypass in the Linux kernel networking PSP netlink interface. The vulnerable code allows the dev-set and key-rotate operations to change shared PSP device configuration and cryptographic key material without requiring CAP_NET_ADMIN; it only checks that the caller is in the relevant network namespace. A local user or compromised process with access to the namespace can therefore perform privileged network-security configuration changes that should be restricted to administrators.

Why it matters to the business

Successful exploitation can let a local attacker or compromised workload disrupt or weaken protected network communications by changing PSP version settings or rotating/modifying cryptographic key material. The most likely operational consequences are service disruption, degraded network security posture, failed encrypted traffic handling, or loss of trust in host-level network protection. The issue is not currently listed in CISA KEV, has low EPSS, and has no known public exploit maturity in the provided data, but it affects a privileged kernel security boundary and should still be remediated through normal kernel patching cycles.

How an attack unfolds

An attacker first obtains local code execution or control of a process inside a Linux network namespace where PSP functionality is available. Instead of needing administrative networking privileges, the attacker communicates with the kernel over the PSP netlink interface and invokes operations intended for administrators. Because vulnerable kernels only validate namespace membership and do not enforce CAP_NET_ADMIN for dev-set or key-rotate, the attacker can change PSP device version configuration or rotate/change PSP key material. Depending on how PSP is deployed, this may cause protected traffic failures, unauthorized security-state changes, or weakening of network cryptographic controls.

How to fix it

Apply a Linux kernel version that includes the upstream fix requiring CAP_NET_ADMIN for PSP dev-set and key-rotate netlink operations. If vendor-fixed package versions are not yet identified, track advisories from the operating system or kernel distribution vendor and upgrade to the first kernel release that backports the fix for CVE-2026-52978. Until patching is complete, reduce exposure by limiting local shell/code-execution access, restricting container privileges and namespace sharing, disabling or avoiding PSP functionality where not required, and ensuring untrusted workloads do not run in network namespaces where PSP device state is configured.

How to confirm the fix worked

Confirm remediation by verifying the running kernel package includes the vendor fix for the PSP netlink permission check. Where safe and authorized, test that an unprivileged process in the relevant network namespace cannot perform PSP dev-set or key-rotate operations and receives a permission error unless it has CAP_NET_ADMIN. Review kernel changelogs or distribution security advisories for the patch described as requiring admin permission for PSP dev-set and key-rotate. Also validate that containers or workloads do not retain unnecessary CAP_NET_ADMIN or share sensitive host network namespaces unless explicitly required.

Typical attack path

1. Gain local code execution on a Linux system or within a container/workload that shares or can access the relevant network namespace.
2. Identify that the kernel exposes PSP netlink functionality and that PSP is configured or usable on the host.
3. Open the appropriate netlink interface from the unprivileged process.
4. Issue PSP dev-set or key-rotate operations without CAP_NET_ADMIN.
5. Modify PSP device configuration or cryptographic key state.
6. Use the resulting state change to disrupt protected traffic, bypass intended administrative controls, or degrade network security.

How to detect it

Look for evidence of unauthorized PSP configuration or key-management activity from non-administrative processes. Useful sources include Linux audit logs, kernel logs, eBPF/netlink telemetry if deployed, endpoint process telemetry, container runtime audit events, and administrative change records for PSP configuration. Investigate PSP dev-set or key-rotate activity performed by users, containers, services, or processes that do not normally manage networking or cryptographic material. Correlate suspicious activity with traffic failures, protected-session resets, PSP negotiation errors, or unexpected key-rotation events. Because exploitation may not leave a unique default log entry, prioritize behavioral detection: unprivileged netlink calls to PSP operations, changes to PSP device state outside maintenance windows, and namespace activity from unexpected workloads. If available, compare observed PSP key rotation/configuration timestamps against approved change-management records.

• psp dev-set
• psp key-rotate
• key-rotate
• dev-set
• CAP_NET_ADMIN
• Operation not permitted
• net: psp
• psp_dev_check_access

What your security team should do

• Inventory Linux systems using kernels that include PSP networking support, prioritizing hosts that run untrusted workloads, containers, multi-tenant services, or workloads with access to sensitive network namespaces.
• Patch affected Linux kernels through the appropriate distribution or appliance vendor as soon as a fixed build is available.
• Treat exploitation risk as local/post-compromise: prioritize systems where attackers could gain low-privileged execution and then manipulate network security state.
• Harden container and workload isolation by avoiding host network namespace sharing and removing unnecessary Linux capabilities, especially CAP_NET_ADMIN.
• Monitor for unusual PSP netlink activity, unexpected PSP key rotations, configuration changes, or correlated network encryption/traffic failures.
• If unauthorized PSP state changes are suspected, rotate affected cryptographic material through trusted administrative channels after patching.