---
id: CVE-2026-99116
title: 'net: psp: do not inherit the Rx association on clone'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: psp: do not inherit the Rx association on clone

  sk->psp_assoc sits past sk_dontcopy_end, so sock_copy() copies it into
  every socket accepted from a listener witho…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6b46ca260e2290e3453d1355ab5b6d283d73d780 <
    a9f14ea73e82db743f0acf4219f499d594589288
  - >-
    Linux >= 6b46ca260e2290e3453d1355ab5b6d283d73d780 <
    c962695467d3ab9738a6508279827ec33a7d2bdf
  - >-
    Linux >= 6b46ca260e2290e3453d1355ab5b6d283d73d780 <
    1d2929d0850fff683b8aff051275945e65f082c8
  - Linux 6.18
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:34:33.109Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99116'
references:
  - url: 'https://git.kernel.org/stable/c/a9f14ea73e82db743f0acf4219f499d594589288'
  - url: 'https://git.kernel.org/stable/c/c962695467d3ab9738a6508279827ec33a7d2bdf'
  - url: 'https://git.kernel.org/stable/c/1d2929d0850fff683b8aff051275945e65f082c8'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.450Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: psp: do not inherit the Rx association on clone

sk->psp_assoc sits past sk_dontcopy_end, so sock_copy() copies it into
every socket accepted from a listener without taking a reference, while
inet_sock_destruct() puts for every inet socket. psp_twsk_init() does
refcount_inc() for the timewait socket, so a child closing through
TIME_WAIT cancels its own put and leaves the association with one
reference and N timewait sockets holding the same pointer. Closing the
listener frees it, and the timewait timers then put freed memory.

Rejecting the association on a listening socket is not sufficient: a socket
can acquire one while established and then be turned back into a listener,
because tcp_disconnect() leaves sk->psp_assoc in place.

  BUG: KASAN: slab-use-after-free in psp_twsk_assoc_free+0x6f/0xf0
  Write of size 4 at addr ffff888110f9255c by task swapper/7/0
   psp_twsk_assoc_free+0x6f/0xf0
   inet_twsk_put+0xda/0x1b0
   call_timer_fn+0x53/0x2e0
   __run_timers+0x764/0xa80
  Freed by task 99:
   kfree+0x1a7/0x500
   process_one_work+0x7ec/0x1100

An association carries a per-connection SPI and key, so a child must not
inherit the parent's. Clear it on clone.

## Affected

- `Linux >= 6b46ca260e2290e3453d1355ab5b6d283d73d780 < a9f14ea73e82db743f0acf4219f499d594589288`
- `Linux >= 6b46ca260e2290e3453d1355ab5b6d283d73d780 < c962695467d3ab9738a6508279827ec33a7d2bdf`
- `Linux >= 6b46ca260e2290e3453d1355ab5b6d283d73d780 < 1d2929d0850fff683b8aff051275945e65f082c8`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.