CVE-2026-99116

In the Linux kernel, the following vulnerability has been resolved:

net: psp: do not inherit the Rx association on clone

sk->psp assoc sits past sk dontcopy end, so sock copy() copies it into every socket accepted from a listener without taking a reference, while inet sock destruct() puts for every inet socket. psp twsk init() does refcount inc() for the timewait socket, so a child closing through TIME WAIT cancels its own put and leaves the association with one reference and N timewait sockets holding the same pointer. Closing the listener frees it, and the timewait timers then put freed memory.

Rejecting the association on a listening socket is not sufficient: a socket can acquire one while established and then be turned back into a listener, because tcp disconnect() leaves sk->psp assoc in place.

BUG: KASAN: slab-use-after-free in psp twsk assoc free+0x6f/0xf0 Write of size 4 at addr ffff888110f9255c by task swapper/7/0 psp twsk assoc free+0x6f/0xf0 inet twsk put+0xda/0x1b0 call timer fn+0x53/0x2e0 run timers+0x764/0xa80 Freed by task 99: kfree+0x1a7/0x500 process one work+0x7ec/0x1100

An association carries a per-connection SPI and key, so a child must not inherit the parent's. Clear it on clone.