PT-2026-61094 · Linux · Linux
CVE-2026-53389
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
net/tcp-ao: fix use-after-free of key in del async path
In tcp ao delete key(), the del async path skips the current key
and rnext key validity checks present in the synchronous path,
assuming these pointers are always NULL on LISTEN sockets. However,
if a key was added with set current=1/set rnext=1 while the socket
was in CLOSE state, current key and rnext key will be non-NULL
after listen() transitions the socket to LISTEN.
When such a key is deleted with del async=1, hlist del rcu() and
call rcu() free the key without clearing the dangling pointers.
After the RCU grace period, getsockopt(TCP AO INFO) dereferences
current key->sndid and rnext key->rcvid from freed slab memory.
Clear current key and rnext key in the del async path when they
reference the key being deleted.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux