Description
In the Linux kernel, the following vulnerability has been resolved:

tls: reject the combination of TLS and sockmap

TLS and sockmap (BPF psock) integration hides a lot of latent bugs.
Bugs which may be more or less relevant for real users but they
are definitely exploitable.

We could not find anyone actively using this integration so let's
reject this config. Adding a TLS socket to a sockmap was already
rejected by sk_psock_init() through the inet_csk_has_ulp() check.
We need to reject the attempts to configure the TLS keys (rather
than adding the ULP itself) because checking prior to the ULP
installation is tricky without risking a race with sockmap getting
added in parallel (sockmap does not hold the socket lock).

This patch is a minimal rejection of the feature. Subsequent patch
in the series will do a light dead code removal. Full cleanup would
require a major rewrite of the Tx path, we don't need skmsg any more.
Published: 2026-09-24
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: Kernel Security Vulnerability
Action: Patch Deployment
AI Analysis

Impact

The Linux kernel bug allows an attacker to configure a TLS socket within a sockmap (BPF psock). The code path that should reject this combination fails, potentially allowing a race condition that could be exploited to alter kernel state or cause execution of arbitrary code at kernel level. This flaw correlates with CWE-362, a race condition vulnerability that may be exploited.

Affected Systems

All Linux kernel configurations that include the sockmap feature and the TLS socket support are affected prior to the commit that rejects the integration. The vulnerable path exists in any kernel version that predates the patch with commit hash 460e6486617c17dd19abe8f3fc67d9a6fa25f8ca. System administrators should verify the kernel version and apply any backported fixes that incorporate this commit.

Risk and Exploitability

No EPSS score is published, and the vulnerability is not listed in the CISA KEV catalog, but the kernel-level bug is inherently exploitable. Attacking the race condition would require privileges or local access to configure TLS sockets and sockmaps simultaneously. While there are no publicly known exploits, the potential for privilege escalation warrants prompt remediation.

Generated by OpenCVE AI on September 25, 2026 at 07:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that includes the patch that rejects TLS sockets from being added to a sockmap (commits 460e6486 or later).
  • If an upgrade is not feasible, disable the sockmap facility or remove the TLS socket integration for the affected device, ensuring that the kernel rejects any attempt to bind a TLS socket to a sockmap.
  • Implement monitoring or logging to detect attempts to combine TLS sockets with sockmaps, and block such operations if the reject logic is not yet in place.

Generated by OpenCVE AI on September 25, 2026 at 07:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 07:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362

Thu, 24 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: tls: reject the combination of TLS and sockmap TLS and sockmap (BPF psock) integration hides a lot of latent bugs. Bugs which may be more or less relevant for real users but they are definitely exploitable. We could not find anyone actively using this integration so let's reject this config. Adding a TLS socket to a sockmap was already rejected by sk_psock_init() through the inet_csk_has_ulp() check. We need to reject the attempts to configure the TLS keys (rather than adding the ULP itself) because checking prior to the ULP installation is tricky without risking a race with sockmap getting added in parallel (sockmap does not hold the socket lock). This patch is a minimal rejection of the feature. Subsequent patch in the series will do a light dead code removal. Full cleanup would require a major rewrite of the Tx path, we don't need skmsg any more.
Title tls: reject the combination of TLS and sockmap
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-25T12:43:33.584Z

Reserved: 2026-09-18T17:59:28.792Z

Link: CVE-2026-93824

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-24T17:17:16.073

Modified: 2026-09-25T13:17:23.220

Link: CVE-2026-93824

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T07:15:17Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')