PT-2026-61094 · Linux · Linux

CVE-2026-53389 · Published 2026-07-19 · Updated 2026-07-19

Mitre

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

net/tcp-ao: fix use-after-free of key in del async path

In tcp ao delete key(), the del async path skips the current key and rnext key validity checks present in the synchronous path, assuming these pointers are always NULL on LISTEN sockets. However, if a key was added with set current=1/set rnext=1 while the socket was in CLOSE state, current key and rnext key will be non-NULL after listen() transitions the socket to LISTEN.

When such a key is deleted with del async=1, hlist del rcu() and call rcu() free the key without clearing the dangling pointers. After the RCU grace period, getsockopt(TCP AO INFO) dereferences current key->sndid and rnext key->rcvid from freed slab memory.

Clear current key and rnext key in the del async path when they reference the key being deleted.

Fix

Related Identifiers

CVE-2026-53389

Affected Products

Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-53389 · Security Note
• https://git.kernel.org/stable/c/6ce7ef41743740ce15c2061561b784148b565b3f · Note
• https://git.kernel.org/stable/c/7ddc29a094d96e9b3aa280433c6dc443df9eabf2 · Note
• https://git.kernel.org/stable/c/e77fbefd1269b5c123e7c651a1ebdce1b87d19a0 · Note
• https://git.kernel.org/stable/c/5ba9950bc9078e19b69cca1e56d1553b125c6857 · Note