Medium 5.5Published Jun 24, 2026

CVE-2026-52978net: psp: require admin permission for dev-set and key-rotate

Updated under an hour ago (Oct 27, 2026, 7:20 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: psp: require admin permission for dev-set and key-rotate The dev-set and key-rotate netlink operations modify shared device state (PSP version configuration and cryptographic key material, respectively) but do not require CAP_NET_ADMIN. The only access control is psp_dev_check_access() which merely verifies netns membership.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 00c94ca2b99e6610e483f92e531b319eeaed94aa before aa1a08a4632af5d1117779e7ff0e32e3c69f29bd; from 00c94ca2b99e6610e483f92e531b319eeaed94aa before fb88a8c86109edb15971481e3de816a8bfdfe571; from 00c94ca2b99e6610e483f92e531b319eeaed94aa before b718342a7fbaa2dff5fefc31988c07af8c6cbc21	CNA record
linux linux_kernel linux:linux_kernel	from 6.18 before 6.18.33; from 6.19 before 7.0.10; 7.1	NVD

References

References

https://git.kernel.org/stable/c/aa1a08a4632af5d1117779e7ff0e32e3c69f29bd	patch
https://git.kernel.org/stable/c/fb88a8c86109edb15971481e3de816a8bfdfe571	patch
https://git.kernel.org/stable/c/b718342a7fbaa2dff5fefc31988c07af8c6cbc21	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.