EUVD-2026-38847
GHSA-gf8v-7h89-7w9j
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Race condition requires precise concurrent timing between association creation and device unregistration, warranting AC:H over the reported AC:L; local low-privilege access is sufficient with strictly no confidentiality or integrity impact.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
net: psp: check for device unregister when creating assoc
psp_assoc_device_get_locked() obtains a psp_dev reference via psp_dev_get_for_sock() (which uses psp_dev_tryget() under RCU); it then acquires psd->lock and drops the reference. Before the lock is taken, psp_dev_unregister() can run to completion: take psd->lock, clear out state, unlock, drop the registration reference.
The expectation is that the lock prevents device unregistration, but much like with netdevs special care has to be taken when "upgrading" a reference to a locked device. Add the missing check if device is still alive. psp_dev_is_registered() exists already but had no callers, which makes me wonder if I either forgot to add this or lost the check during refactoring...
AnalysisAI
Race condition in the Linux kernel PSP network subsystem allows a local low-privileged attacker to crash the kernel through a TOCTOU flaw in device association creation. In psp_assoc_device_get_locked(), a device reference acquired under RCU becomes stale before the protecting lock is taken if psp_dev_unregister() completes concurrently, leaving the kernel operating on freed or invalid device state. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access with at least low-privilege credentials on the target system (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 5.5 (Medium, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects a local, low-privilege denial-of-service with no confidentiality or integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local low-privileged user on a system with an active PSP network interface initiates creation of a new PSP device association while concurrently triggering or observing a PSP device unregistration event. If `psp_dev_unregister()` completes in the narrow window between the RCU-protected `psp_dev_tryget()` call and the subsequent `psd->lock` acquisition inside `psp_assoc_device_get_locked()`, the kernel proceeds to operate on cleared or freed device state, resulting in a null pointer dereference or use-after-free that panics the kernel. … |
| Remediation | Upgrade to a patched Linux kernel version: 7.1, 7.0.10, or 6.18.33. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-667 – Improper Locking
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today