HIGH Introduced in 6.18
tcp TimeWait Leak
CVE-2026-68379
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: tcp: fix TIME_WAIT socket reference leak on PSP policy failure Release the TIME_WAIT socket reference and jump to discard_it upon PSP policy failure in both IPv4 and IPv6 receive paths. This prevents a memory leak of tcp_tw_bucket structures.
02KernelScan AI Analysis
Risk summary
An unauthenticated remote attacker can send TCP packets to a host with PSP-enabled connections in TIME_WAIT state, triggering a memory leak of TIME_WAIT socket structures on every packet that fails PSP policy validation. Repeated exploitation can exhaust kernel memory and cause a system-wide denial of service. The vulnerability affects both IPv4 and IPv6 TCP receive paths.
Vulnerability analysis
When an incoming TCP packet arrives for a connection in TIME_WAIT state, the receive path performs a PSP security policy check on the socket. If that check fails, the original code discards the packet but forgets to release the reference count held on the TIME_WAIT socket, leaking one kernel structure per failed check. An attacker who can send TCP traffic to the host can repeat this indefinitely, accumulating leaked structures until kernel memory is exhausted. The fix releases the TIME_WAIT socket reference and routes the packet to the normal discard path when the PSP policy check fails, closing the leak. This is reachable from the network by any unauthenticated sender, but only on systems where the PSP TCP feature is active and connections exist in TIME_WAIT state with PSP policy enforced.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 6.18 | 7.2-rc4 | 2c1931a81122 |
| 7.1 | 6.18 | 7.1.6 | 374742a961be |
| 6.18 | 6.18 | 6.18.42 | e666af5dcc90 |