CVE-2026-53389: net/tcp-ao: fix use-after-free of key in del_async path
In the Linux kernel, the following vulnerability has been resolved:
net/tcp-ao: fix use-after-free of key in delasync path
In tcpaodeletekey(), the delasync path skips the currentkey and rnextkey validity checks present in the synchronous path, assuming these pointers are always NULL on LISTEN sockets. However, if a key was added with setcurrent=1/setrnext=1 while the socket was in CLOSE state, currentkey and rnextkey will be non-NULL after listen() transitions the socket to LISTEN.
When such a key is deleted with delasync=1, hlistdelrcu() and callrcu() free the key without clearing the dangling pointers. After the RCU grace period, getsockopt(TCPAOINFO) dereferences currentkey->sndid and rnextkey->rcvid from freed slab memory.
Clear currentkey and rnextkey in the delasync path when they reference the key being deleted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the fix in the Linux kernel for net/tcp-ao (use-after-free in del_async path) so that the del_async path clears current_key and rnext_key before hlist_del_rcu()/call_rcu(), preventing call_rcu() from freeing keys while dangling pointers (current_key->sndid, rnext_key->rcvid) may still be used.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53389?
The severity of CVE-2026-53389 is rated high with a CVSS score of 7.8.
What vulnerability is addressed in CVE-2026-53389?
CVE-2026-53389 addresses a use-after-free vulnerability in the Linux kernel's tcp_ao_delete_key() function.
How do I fix CVE-2026-53389?
To fix CVE-2026-53389, you should update to the latest version of the Linux kernel where the vulnerability has been patched.
What software is affected by CVE-2026-53389?
CVE-2026-53389 affects the Linux kernel.
What type of vulnerability is CVE-2026-53389?
CVE-2026-53389 is classified as a use-after-free vulnerability.