What’s Vulnerable › Vulnerabilities

CVE-2026-52978: net: psp: require admin permission for dev-set and key-rotate

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-24 · updated 2026-07-14

Description

In the Linux kernel, the following vulnerability has been resolved: net: psp: require admin permission for dev-set and key-rotate The dev-set and key-rotate netlink operations modify shared device state (PSP version configuration and cryptographic key material, respectively) but do not require CAP_NET_ADMIN. The only access control is psp_dev_check_access() which merely verifies netns membership.

Affected products

• Linux kernel: from 6.18 before 6.18.33; from 6.19 before 7.0.10; 7.1-rc1 — fixed in 6.18.33, 7.0.10

How to fix

Upgrade to a fixed version: Linux kernel 6.18.33, 7.0.10. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/aa1a08a4632af5d1117779e7ff0e32e3c69f29bd
• https://git.kernel.org/stable/c/b718342a7fbaa2dff5fefc31988c07af8c6cbc21
• https://git.kernel.org/stable/c/fb88a8c86109edb15971481e3de816a8bfdfe571

Get alerted when CVE-2026-52978 or the next vulnerability affects your stack