{"id":"CVE-2026-93824","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ntls: reject the combination of TLS and sockmap\n\nTLS and sockmap (BPF psock) integration hides a lot of latent bugs.\nBugs which may be more or less relevant for real use…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntls: reject the combination of TLS and sockmap\n\nTLS and sockmap (BPF psock) integration hides a lot of latent bugs.\nBugs which may be more or less relevant for real use…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c3d4d537337f69e405a36fa561e7292ee4148bf7","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a08e780b6cc1153cbff8be55de9ec9da809e344f","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 460e6486617c17dd19abe8f3fc67d9a6fa25f8ca","Linux < 6.12.111","Linux < 6.18.53","Linux (all versions)"],"published":"2026-09-24","updated":"2026-09-24","sourceUpdated":"2026-09-24T17:17:16.073","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93824","references":[{"url":"https://git.kernel.org/stable/c/460e6486617c17dd19abe8f3fc67d9a6fa25f8ca","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a08e780b6cc1153cbff8be55de9ec9da809e344f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3d4d537337f69e405a36fa561e7292ee4148bf7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-24T16:47:15.890Z","slug":"CVE-2026-93824","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntls: reject the combination of TLS and sockmap\n\nTLS and sockmap (BPF psock) integration hides a lot of latent bugs.\nBugs which may be more or less relevant for real users but they\nare definitely exploitable.\n\nWe could not find anyone actively using this integration so let's\nreject this config. Adding a TLS socket to a sockmap was already\nrejected by sk_psock_init() through the inet_csk_has_ulp() check.\nWe need to reject the attempts to configure the TLS keys (rather\nthan adding the ULP itself) because checking prior to the ULP\ninstallation is tricky without risking a race with sockmap getting\nadded in parallel (sockmap does not hold the socket lock).\n\nThis patch is a minimal rejection of the feature. Subsequent patch\nin the series will do a light dead code removal. Full cleanup would\nrequire a major rewrite of the Tx path, we don't need skmsg any more.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}