Cloudanix VulnDB

CVE-2026-99116

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A recent Linux kernel bug can make the system crash when handling certain network connections, so installing the latest operating system updates will prevent unexpected restarts.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

Use-after-free in Linux kernel PSP networking code where sk->psp_assoc is incorrectly copied via sock_copy() without reference management, leading to mismatched refcounts between child sockets, timewait sockets, and listener closure; timer callbacks then access freed memory.

Why it matters to the business

Affected Linux systems may experience kernel crashes or instability during routine network socket operations involving listeners and connection teardown; low EPSS and no KEV status indicate limited immediate exploitation risk, but unpatched kernels in production introduce denial-of-service exposure three days after disclosure.

How an attack unfolds

An attacker triggers socket cloning on a listener that holds a PSP association, allows the socket to enter TIME_WAIT states, then closes the listener; subsequent timer callbacks in psp_twsk_assoc_free dereference the freed association, causing slab-use-after-free.

How to fix it

Apply the upstream kernel patch titled 'net: psp: do not inherit the Rx association on clone' or upgrade to a kernel release containing the fix; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting net/psp code for the clone rejection logic; recompile with KASAN and reproduce the original socket lifecycle to verify absence of slab-use-after-free reports.

Typical attack path

  1. Acquire or force a PSP association on an established socket
  2. Trigger tcp_disconnect() to retain the association while reverting to listener state
  3. Close child sockets to enter TIME_WAIT while listener holds the original reference
  4. Close the listener to free the association
  5. Wait for timewait timers to execute psp_twsk_assoc_free on freed memory

How to detect it

Search kernel logs and KASAN reports for mentions of psp_twsk_assoc_free, inet_twsk_put, or slab-use-after-free during timer execution; correlate with processes closing TCP listeners or entering TIME_WAIT.

  • psp_twsk_assoc_free+0x6f/0xf0
  • KASAN: slab-use-after-free
  • Write of size 4 at addr .* by task swapper

What your security team should do

  • Prioritize kernel updates on all externally reachable Linux hosts within the next maintenance window
  • Enable KASAN or similar memory debugging on test systems to validate the fix
  • Monitor changelogs for stable kernel releases containing the PSP association change
  • Review network-facing services that use custom socket options for exposure

The record

In the Linux kernel, the following vulnerability has been resolved: net: psp: do not inherit the Rx association on clone sk->psp_assoc sits past sk_dontcopy_end, so sock_copy() copies it into every socket accepted from a listener without taking a reference, while inet_sock_destruct() puts for every inet socket. psp_twsk_init() does refcount_inc() for the timewait socket, so a child closing through TIME_WAIT cancels its own put and leaves the association with one reference and N timewait sockets holding the same pointer. Closing the listener frees it, and the timewait timers then put freed memory. Rejecting the association on a listening socket is not sufficient: a socket can acquire one while established and then be turned back into a listener, because tcp_disconnect() leaves sk->psp_assoc in place. BUG: KASAN: slab-use-after-free in psp_twsk_assoc_free+0x6f/0xf0 Write of size 4 at addr ffff888110f9255c by task swapper/7/0 psp_twsk_assoc_free+0x6f/0xf0 inet_twsk_put+0xda/0x1b0 call_timer_fn+0x53/0x2e0 __run_timers+0x764/0xa80 Freed by task 99: kfree+0x1a7/0x500 process_one_work+0x7ec/0x1100 An association carries a per-connection SPI and key, so a child must not inherit the parent's. Clear it on clone.

Affected packages

Ecosystem Package Introduced Fixed