Skip to main content

Linux Kernel EUVDEUVD-2026-38847

| CVE-2026-52979 MEDIUM
Improper Locking (CWE-667)
2026-06-24 Linux GHSA-gf8v-7h89-7w9j
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Race condition requires precise concurrent timing between association creation and device unregistration, warranting AC:H over the reported AC:L; local low-privilege access is sufficient with strictly no confidentiality or integrity impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.7 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 14, 2026 - 22:04 vuln.today
CVSS changed
Jul 14, 2026 - 16:52 NVD
5.5 (MEDIUM)
CVE Published
Jun 24, 2026 - 16:28 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:28 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: psp: check for device unregister when creating assoc

psp_assoc_device_get_locked() obtains a psp_dev reference via psp_dev_get_for_sock() (which uses psp_dev_tryget() under RCU); it then acquires psd->lock and drops the reference. Before the lock is taken, psp_dev_unregister() can run to completion: take psd->lock, clear out state, unlock, drop the registration reference.

The expectation is that the lock prevents device unregistration, but much like with netdevs special care has to be taken when "upgrading" a reference to a locked device. Add the missing check if device is still alive. psp_dev_is_registered() exists already but had no callers, which makes me wonder if I either forgot to add this or lost the check during refactoring...

AnalysisAI

Race condition in the Linux kernel PSP network subsystem allows a local low-privileged attacker to crash the kernel through a TOCTOU flaw in device association creation. In psp_assoc_device_get_locked(), a device reference acquired under RCU becomes stale before the protecting lock is taken if psp_dev_unregister() completes concurrently, leaving the kernel operating on freed or invalid device state. No public exploit has been identified and EPSS stands at 0.17% (6th percentile), reflecting minimal active exploitation risk despite the well-characterized code-level race condition.

Technical ContextAI

The flaw resides in the Linux kernel PSP network subsystem's device lifecycle management and is classified as CWE-667 (Improper Locking) - specifically a TOCTOU race condition. psp_assoc_device_get_locked() acquires a psp_dev reference via psp_dev_tryget() under RCU, then drops that reference before taking psd->lock. In the interval between the reference drop and the lock acquisition, psp_dev_unregister() can run to completion: it takes the lock, clears all device state, unlocks, and drops the registration reference. The expectation that holding the lock prevents unregistration is violated by this upgrade gap. The fix backfills a psp_dev_is_registered() check immediately after lock acquisition to detect the already-unregistered condition. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the Linux kernel across all affected stable branches.

RemediationAI

Upgrade to a patched Linux kernel version: 7.1, 7.0.10, or 6.18.33. Three stable-branch fix commits are available and independently verifiable at https://git.kernel.org/stable/c/d90df5ce6deb2424de3ad89bcc693ac1b67accc9, https://git.kernel.org/stable/c/e201c57073e624dd2ba5beaf9eda31e19b77b332, and https://git.kernel.org/stable/c/b89769f936a8fa9e66de72ddc1b71a9745a488e6. Downstream distributions should be monitored for backport packages carrying these commits to the relevant distribution kernel. If immediate patching is not feasible, restricting local shell access on systems actively running PSP network associations narrows the attack surface to already-privileged users, though this is an incomplete compensating control with the operational trade-off of limiting legitimate administrative access.

Same weakness CWE-667 – Improper Locking

View all
CVE-2025-43510 HIGH POC
7.8
CVE-2019-5886 CRITICAL POC
9.8
CVE-2020-13246 HIGH POC
7.5
CVE-2019-15513 HIGH POC
7.5
CVE-2019-11599 HIGH POC
7.0
CVE-2023-21400 MEDIUM POC
6.7
CVE-2021-20291 MEDIUM POC
6.5
CVE-2026-53049 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-38847 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy