PT-2026-64680 · Linux · Linux
CVE-2026-64459
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
tcp: restore RCU grace period in tcp ao destroy sock
Commit 51e547e8c89c ("tcp: Free TCP-AO/TCP-MD5 info/keys without RCU")
removed the call rcu() callback from tcp ao destroy sock(), arguing that
"the destruction of info/keys is delayed until the socket destructor"
and therefore "no one can discover it anymore".
That argument does not hold for the call site in tcp connect()
(net/ipv4/tcp output.c:4327-4332). At that point the socket is in
TCP SYN SENT, has already been inserted into the inet ehash by
inet hash connect() in tcp v4 connect(), and is therefore very much
discoverable: any softirq running tcp v4 rcv() on another CPU can take
the socket out of the ehash, walk into tcp inbound hash(), and load
tp->ao info via implicit RCU before bh lock sock nested() is taken on
the destroying CPU.
The reader path then enters tcp ao do lookup() (net/ipv4/tcp ao.c:208)
which re-loads tp->ao info via rcu dereference check(); the re-load can
still observe the (about-to-be-freed) pointer because there is no
synchronize rcu() between rcu assign pointer(tp->ao info, NULL) and
tcp ao info free() in tcp ao destroy sock(). The captured pointer is
then walked at line 223:
hlist for each entry rcu(key, &ao->head, node, ...)The writer's synchronous kfree() is free to complete between the line
218 re-fetch and the line 223 hlist iteration. The slab is reused
(or simply LIST POISON1-stamped if not yet reused) and the iteration
walks attacker-controlled or poison memory in softirq context.
Reproducer (no debug shim, stock x86 64 v7.1-rc2 SMP+KASAN, QEMU+KVM):
an unprivileged uid=1000 process inside CLONE NEWUSER|CLONE NEWNET
installs TCP MD5SIG + TCP AO ADD KEY on a TCP socket, sprays forged
TCP-AO segments toward its eventual 4-tuple via raw sockets, then
calls connect(). The md5-wins reconciliation in tcp connect() fires
tcp ao destroy sock(); the softirq backlog reader on the loopback
NAPI path crashes on the freed ao->head.first walk:
Oops: general protection fault, probably for non-canonical
address 0xfbd59c000000002f
KASAN: maybe wild-memory-access in range
[0xdead000000000178-0xdead00000000017f]
CPU: 0 UID: 1000 PID: 100 Comm: repro userns
RIP: 0010: tcp ao do lookup+0x107/0x1c0
Call Trace:
tcp ao do lookup+0x107/0x1c0
tcp ao inbound lookup.constprop.0+0x12a/0x200
tcp inbound ao hash+0x5ea/0x1520
tcp inbound hash+0x7ce/0x1240
tcp v4 rcv+0x1e7a/0x3e10
...
Restore the RCU grace period: re-add struct rcu head to tcp ao info
and replace the synchronous tcp ao info free() with a call rcu()
callback. Readers that captured tp->ao info before rcu assign pointer
NULLed it now see the object remain valid until rcu read unlock().
With the patch applied the reproducer runs cleanly for 2000 iterations
on the same kernel build.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux