The Linux kernel contained a vulnerability in the PSP security protocol subsystem where the dev-set and key-rotate netlink operations could modify shared device state (PSP version configuration and cryptographic key material) without requiring the CAP_NET_ADMIN capability. The only access control was a check for network namespace membership, which was insufficient. This flaw was resolved by requiring administrative permissions for these operations. The vulnerability is tracked as CVE-2026-52978 and affects Linux kernel versions prior to 7.0.0-28.28 and related variants. The issue has been addressed in official Ubuntu security updates for the 26.04 LTS release and others, with a reboot required after updating. The CVSS v3.1 score is 5.5 (medium severity), reflecting local attack vector with low privileges required and no user interaction, causing availability impact but no confidentiality or integrity loss.

A local attacker with limited privileges could exploit this vulnerability to perform unauthorized modifications to shared device state related to the PSP security protocol, potentially impacting system availability. The vulnerability does not affect confidentiality or integrity directly but could lead to denial of service or disruption of device operations. No known exploits are reported in the wild at this time.

An official patch is available and should be applied by updating the Linux kernel packages to versions 7.0.0-28.28 or later (and corresponding patched builds) as provided by Ubuntu security notices USN-8566-1 and USN-8568-1. After applying the update, a system reboot is required to complete remediation. Due to ABI changes, recompilation and reinstallation of third-party kernel modules may be necessary. No additional mitigation actions are required beyond applying the official update.