The Linux kernel vulnerability CVE-2026-52979 concerns the PSP security protocol subsystem where the function psp_assoc_device_get_locked() obtains a device reference without verifying if the device has been unregistered. This race condition allows psp_dev_unregister() to complete and clear device state before the lock is acquired, violating assumptions about device availability. The fix adds a missing check using psp_dev_is_registered() to ensure the device is still alive before proceeding. This vulnerability is among several security issues fixed in the Linux kernel by Ubuntu in July 2026, affecting various architectures and subsystems. The vulnerability has a CVSS 3.1 score of 5.5 (medium severity) with local attack vector, low complexity, low privileges required, no user interaction, and impacts availability. No known exploits in the wild have been reported. The vendor advisory confirms a patch is available and recommends updating to fixed kernel versions.

The vulnerability could allow a local attacker with low privileges to cause a denial of service by triggering a race condition in the PSP security protocol device handling, potentially destabilizing the kernel or causing crashes. There is no confidentiality or integrity impact reported. The medium severity rating reflects the availability impact without escalation of privileges or data compromise. No active exploitation has been observed.

A patch is available and included in updated Linux kernel packages for Ubuntu linux-hwe-edge and related kernels. Users should apply the updates and reboot their systems to ensure the vulnerability is remediated. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. Follow the vendor advisory instructions for updating to the specified fixed package versions. No additional mitigation steps are indicated by the vendor.