Skip to main content

Linux Kernel CVE-2026-52978

| EUVDEUVD-2026-38846 MEDIUM
2026-06-24 Linux GHSA-7rc7-4hq2-f9hm
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.1 HIGH

Unauthorized key rotation constitutes high integrity impact; AV:L and PR:L confirmed by netlink local access and netns-only check.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.7 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 22, 2026 - 20:54 vuln.today
CVSS changed
Jul 14, 2026 - 16:52 NVD
5.5 (MEDIUM)
CVE Published
Jun 24, 2026 - 16:28 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:28 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: psp: require admin permission for dev-set and key-rotate

The dev-set and key-rotate netlink operations modify shared device state (PSP version configuration and cryptographic key material, respectively) but do not require CAP_NET_ADMIN. The only access control is psp_dev_check_access() which merely verifies netns membership.

AnalysisAI

Missing CAP_NET_ADMIN enforcement in the Linux kernel PSP (PSP Security Protocol) netlink subsystem allows any local user with low privileges within the same network namespace to invoke the dev-set and key-rotate operations - modifying PSP version configuration and rotating cryptographic key material without authorization. The only access control in place, psp_dev_check_access(), validates only network namespace membership and does not enforce administrative capability. This enables unauthorized disruption of PSP-encrypted network communications and unauthorized modification of in-use cryptographic keying material. No public exploit code has been identified at time of analysis, and EPSS exploitation probability is very low at 0.17% (7th percentile).

Technical ContextAI

PSP (PSP Security Protocol) is a Google-developed link-layer encryption protocol designed for data-center host-to-host traffic, recently upstreamed into the Linux kernel network stack. The affected code exposes two netlink operations - dev-set (modifying PSP protocol version configuration) and key-rotate (replacing active cryptographic key material) - that mutate shared, security-critical device state. The access control function psp_dev_check_access() performs only a network-namespace membership check, which any low-privileged process in the same netns satisfies. The correct Linux privilege gate for operations that mutate network device state or keying material is CAP_NET_ADMIN, which is not enforced here. CWE data was not provided; the root cause class is Missing Authorization / Improper Privilege Management (analogous to CWE-862 or CWE-269). Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* for kernel versions from the introduction commit 00c94ca2b99e6610e483f92e531b319eeaed94aa through the respective stable-branch fix commits.

RemediationAI

Upgrade to a patched Linux kernel release: 6.18.33, 7.0.10, or 7.1 as appropriate for the deployed stable branch. The upstream fixes are available at https://git.kernel.org/stable/c/aa1a08a4632af5d1117779e7ff0e32e3c69f29bd, https://git.kernel.org/stable/c/fb88a8c86109edb15971481e3de816a8bfdfe571, and https://git.kernel.org/stable/c/b718342a7fbaa2dff5fefc31988c07af8c6cbc21. Ubuntu users should apply the updates referenced in USN-8568-1 (https://ubuntu.com/security/notices/USN-8568-1) and USN-8566-1 (https://ubuntu.com/security/notices/USN-8566-1). If an immediate kernel upgrade is not feasible, a compensating control is to restrict execution of PSP netlink-capable processes to trusted users via network namespace isolation - placing PSP-managing processes in dedicated namespaces inaccessible to unprivileged users. Alternatively, if PSP is not in active use, unloading or blacklisting the PSP kernel module eliminates the attack surface entirely with no operational trade-off for non-PSP environments. Patching is strongly preferred, as namespace controls are a defense-in-depth measure, not a full substitute for the missing capability check.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-52978 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy