{"id":"CVE-2026-53389","state":"PUBLISHED","title":"net/tcp-ao: fix use-after-free of key in del_async path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tcp-ao: fix use-after-free of key in del_async path\n\nIn tcp_ao_delete_key(), the del_async path skips the current_key\nand rnext_key validity checks present in the synchronous path,\nassuming these pointers are always NULL on LISTEN sockets.  However,\nif a key was added with set_current=1/set_rnext=1 while the socket\nwas in CLOSE state, current_key and rnext_key will be non-NULL\nafter listen() transitions the socket to LISTEN.\n\nWhen such a key is deleted with del_async=1, hlist_del_rcu() and\ncall_rcu() free the key without clearing the dangling pointers.\nAfter the RCU grace period, getsockopt(TCP_AO_INFO) dereferences\ncurrent_key->sndid and rnext_key->rcvid from freed slab memory.\n\nClear current_key and rnext_key in the del_async path when they\nreference the key being deleted.","publishedAt":"2026-07-19T12:01:54.386Z","updatedAt":"2026-08-17T04:50:40.399Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d6732b95b6fbbc6d5bb9d2f809e275763640c4a2","status":"affected","lessThan":"6ce7ef41743740ce15c2061561b784148b565b3f","versionType":"git"},{"version":"d6732b95b6fbbc6d5bb9d2f809e275763640c4a2","status":"affected","lessThan":"e77fbefd1269b5c123e7c651a1ebdce1b87d19a0","versionType":"git"},{"version":"d6732b95b6fbbc6d5bb9d2f809e275763640c4a2","status":"affected","lessThan":"7ddc29a094d96e9b3aa280433c6dc443df9eabf2","versionType":"git"},{"version":"d6732b95b6fbbc6d5bb9d2f809e275763640c4a2","status":"affected","lessThan":"5ba9950bc9078e19b69cca1e56d1553b125c6857","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/tcp_ao.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.7","versionType":"semver"},{"version":"6.12.95","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.38","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.3","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/tcp_ao.c"]}],"references":["https://git.kernel.org/stable/c/6ce7ef41743740ce15c2061561b784148b565b3f","https://git.kernel.org/stable/c/e77fbefd1269b5c123e7c651a1ebdce1b87d19a0","https://git.kernel.org/stable/c/7ddc29a094d96e9b3aa280433c6dc443df9eabf2","https://git.kernel.org/stable/c/5ba9950bc9078e19b69cca1e56d1553b125c6857"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/53xxx/CVE-2026-53389.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-53389","state":"PUBLISHED","datePublished":"2026-07-19T12:01:54.386Z","dateUpdated":"2026-08-17T04:50:40.399Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-06-09T07:44:35.402Z"},"containers":{"cna":{"title":"net/tcp-ao: fix use-after-free of key in del_async path","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tcp-ao: fix use-after-free of key in del_async path\n\nIn tcp_ao_delete_key(), the del_async path skips the current_key\nand rnext_key validity checks present in the synchronous path,\nassuming these pointers are always NULL on LISTEN sockets.  However,\nif a key was added with set_current=1/set_rnext=1 while the socket\nwas in CLOSE state, current_key and rnext_key will be non-NULL\nafter listen() transitions the socket to LISTEN.\n\nWhen such a key is deleted with del_async=1, hlist_del_rcu() and\ncall_rcu() free the key without clearing the dangling pointers.\nAfter the RCU grace period, getsockopt(TCP_AO_INFO) dereferences\ncurrent_key->sndid and rnext_key->rcvid from freed slab memory.\n\nClear current_key and rnext_key in the del_async path when they\nreference the key being deleted."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d6732b95b6fbbc6d5bb9d2f809e275763640c4a2","status":"affected","lessThan":"6ce7ef41743740ce15c2061561b784148b565b3f","versionType":"git"},{"version":"d6732b95b6fbbc6d5bb9d2f809e275763640c4a2","status":"affected","lessThan":"e77fbefd1269b5c123e7c651a1ebdce1b87d19a0","versionType":"git"},{"version":"d6732b95b6fbbc6d5bb9d2f809e275763640c4a2","status":"affected","lessThan":"7ddc29a094d96e9b3aa280433c6dc443df9eabf2","versionType":"git"},{"version":"d6732b95b6fbbc6d5bb9d2f809e275763640c4a2","status":"affected","lessThan":"5ba9950bc9078e19b69cca1e56d1553b125c6857","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/tcp_ao.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.7","versionType":"semver"},{"version":"6.12.95","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.38","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.3","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/tcp_ao.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/6ce7ef41743740ce15c2061561b784148b565b3f"},{"url":"https://git.kernel.org/stable/c/e77fbefd1269b5c123e7c651a1ebdce1b87d19a0"},{"url":"https://git.kernel.org/stable/c/7ddc29a094d96e9b3aa280433c6dc443df9eabf2"},{"url":"https://git.kernel.org/stable/c/5ba9950bc9078e19b69cca1e56d1553b125c6857"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local `setsockopt`/`getsockopt` syscalls on a TCP socket owned by the attacker; the UAF is triggered in socket-option management, not by remote TCP-AO packet processing on the listen path.\nAC:L - An attacker who controls the socket can deterministically perform add-with-set_current/set_rnext on CLOSE, listen(), del_async delete, wait for RCU, then getsockopt(TCP_AO_INFO) without depending on conditions outside their control.\nPR:L - No capability checks protect TCP-AO socket options beyond socket ownership; an unprivileged local user (including in a user namespace) can create a listening TCP socket, configure TCP-AO keys, and trigger the bug on their own socket.\nUI:N - No victim interaction is required; the attacker drives the full exploit sequence through their own socket file descriptor.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same security domain; this is not a cross-VM, cross-container, or IOMMU boundary escape.\nC:H - The bug is a use-after-free where `getsockopt(TCP_AO_INFO)` reads `sndid`/`rcvid` from freed `tcp_ao_key` slab memory, enabling information disclosure from attacker-influenced freed heap contents.\nI:H - Use-after-free of a heap-allocated `tcp_ao_key` structure can be leveraged with heap grooming for arbitrary memory corruption and potential kernel code execution, not merely a bounded write.\nA:H - Dereferencing freed kernel memory via `getsockopt(TCP_AO_INFO)` can cause kernel oops/panic and denial of service even when full exploitation is not attempted."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T04:50:40.399Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.95"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.18.38"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"7.1.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}