CVE-2026-53389net/tcp-ao: fix use-after-free of key in del_async path
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free of key in del_async path In tcp_ao_delete_key(), the del_async path skips the current_key and rnext_key validity checks present in the synchronous path, assuming these pointers are always NULL on LISTEN sockets. However, if a key was added with set_current=1/set_rnext=1 while the socket was in CLOSE state, current_key and rnext_key will be non-NULL after listen() transitions the socket to LISTEN. When such a key is deleted with del_async=1, hlist_del_rcu() and call_rcu() free the key without clearing the dangling pointers. After the RCU grace period, getsockopt(TCP_AO_INFO) dereferences current_key->sndid and rnext_key->rcvid from freed slab memory. Clear current_key and rnext_key in the del_async path when they reference the key being deleted.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d6732b95b6fbbc6d5bb9d2f809e275763640c4a2 before 6ce7ef41743740ce15c2061561b784148b565b3f; from d6732b95b6fbbc6d5bb9d2f809e275763640c4a2 before e77fbefd1269b5c123e7c651a1ebdce1b87d19a0; from d6732b95b6fbbc6d5bb9d2f809e275763640c4a2 before 7ddc29a094d96e9b3aa280433c6dc443df9eabf2; from d6732b95b6fbbc6d5bb9d2f809e275763640c4a2 before 5ba9950bc9078e19b69cca1e56d1553b125c6857 | CNA record |
linux linux_kernel linux:linux_kernel | from 6.7 before 6.12.95; from 6.13 before 6.18.38; from 6.19 before 7.1.3 | NVD |
References
- https://git.kernel.org/stable/c/6ce7ef41743740ce15c2061561b784148b565b3fpatch
- https://git.kernel.org/stable/c/e77fbefd1269b5c123e7c651a1ebdce1b87d19a0patch
- https://git.kernel.org/stable/c/7ddc29a094d96e9b3aa280433c6dc443df9eabf2patch
- https://git.kernel.org/stable/c/5ba9950bc9078e19b69cca1e56d1553b125c6857patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.