CVE-2026-93824 (GCVE-0-2026-93824)

Vulnerability from cvelistv5 – Published: 2026-09-24 16:03 – Updated: 2026-09-25 12:43
VLAI
Title
tls: reject the combination of TLS and sockmap
Summary
In the Linux kernel, the following vulnerability has been resolved: tls: reject the combination of TLS and sockmap TLS and sockmap (BPF psock) integration hides a lot of latent bugs. Bugs which may be more or less relevant for real users but they are definitely exploitable. We could not find anyone actively using this integration so let's reject this config. Adding a TLS socket to a sockmap was already rejected by sk_psock_init() through the inet_csk_has_ulp() check. We need to reject the attempts to configure the TLS keys (rather than adding the ULP itself) because checking prior to the ULP installation is tricky without risking a race with sockmap getting added in parallel (sockmap does not hold the socket lock). This patch is a minimal rejection of the feature. Subsequent patch in the series will do a light dead code removal. Full cleanup would require a major rewrite of the Tx path, we don't need skmsg any more.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d3b18ad31f93d0b6bae105c679018a1ba7daa9ca , < c3d4d537337f69e405a36fa561e7292ee4148bf7 (git)
Affected: d3b18ad31f93d0b6bae105c679018a1ba7daa9ca , < a08e780b6cc1153cbff8be55de9ec9da809e344f (git)
Affected: d3b18ad31f93d0b6bae105c679018a1ba7daa9ca , < 460e6486617c17dd19abe8f3fc67d9a6fa25f8ca (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.20
Unaffected: 0 , < 4.20 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c3d4d537337f69e405a36fa561e7292ee4148bf7",
              "status": "affected",
              "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
              "versionType": "git"
            },
            {
              "lessThan": "a08e780b6cc1153cbff8be55de9ec9da809e344f",
              "status": "affected",
              "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
              "versionType": "git"
            },
            {
              "lessThan": "460e6486617c17dd19abe8f3fc67d9a6fa25f8ca",
              "status": "affected",
              "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: reject the combination of TLS and sockmap\n\nTLS and sockmap (BPF psock) integration hides a lot of latent bugs.\nBugs which may be more or less relevant for real users but they\nare definitely exploitable.\n\nWe could not find anyone actively using this integration so let\u0027s\nreject this config. Adding a TLS socket to a sockmap was already\nrejected by sk_psock_init() through the inet_csk_has_ulp() check.\nWe need to reject the attempts to configure the TLS keys (rather\nthan adding the ULP itself) because checking prior to the ULP\ninstallation is tricky without risking a race with sockmap getting\nadded in parallel (sockmap does not hold the socket lock).\n\nThis patch is a minimal rejection of the feature. Subsequent patch\nin the series will do a light dead code removal. Full cleanup would\nrequire a major rewrite of the Tx path, we don\u0027t need skmsg any more."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T12:43:33.584Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c3d4d537337f69e405a36fa561e7292ee4148bf7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a08e780b6cc1153cbff8be55de9ec9da809e344f"
        },
        {
          "url": "https://git.kernel.org/stable/c/460e6486617c17dd19abe8f3fc67d9a6fa25f8ca"
        }
      ],
      "title": "tls: reject the combination of TLS and sockmap",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93824",
    "datePublished": "2026-09-24T16:03:02.783Z",
    "dateReserved": "2026-09-18T17:59:28.792Z",
    "dateUpdated": "2026-09-25T12:43:33.584Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-93824",
      "date": "2026-09-25",
      "epss": "0.00166",
      "percentile": "0.05182"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/tls/tls_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c3d4d537337f69e405a36fa561e7292ee4148bf7",
                    "status": "affected",
                    "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a08e780b6cc1153cbff8be55de9ec9da809e344f",
                    "status": "affected",
                    "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "460e6486617c17dd19abe8f3fc67d9a6fa25f8ca",
                    "status": "affected",
                    "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/tls/tls_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.20"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: reject the combination of TLS and sockmap\n\nTLS and sockmap (BPF psock) integration hides a lot of latent bugs.\nBugs which may be more or less relevant for real users but they\nare definitely exploitable.\n\nWe could not find anyone actively using this integration so let\u0027s\nreject this config. Adding a TLS socket to a sockmap was already\nrejected by sk_psock_init() through the inet_csk_has_ulp() check.\nWe need to reject the attempts to configure the TLS keys (rather\nthan adding the ULP itself) because checking prior to the ULP\ninstallation is tricky without risking a race with sockmap getting\nadded in parallel (sockmap does not hold the socket lock).\n\nThis patch is a minimal rejection of the feature. Subsequent patch\nin the series will do a light dead code removal. Full cleanup would\nrequire a major rewrite of the Tx path, we don\u0027t need skmsg any more."
          }
        ],
        "id": "CVE-2026-93824",
        "lastModified": "2026-09-25T13:17:23.220",
        "metrics": {},
        "published": "2026-09-24T17:17:16.073",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/460e6486617c17dd19abe8f3fc67d9a6fa25f8ca"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a08e780b6cc1153cbff8be55de9ec9da809e344f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c3d4d537337f69e405a36fa561e7292ee4148bf7"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-09-24T23:47:08Z",
      "cve": "CVE-2026-93824",
      "id": "CVE-2026-93824",
      "initial_release_date": "2026-09-24T23:47:08Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-93824",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-93824.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.