Executive brief
A vulnerability in the Linux kernel's networking component could allow an attacker to cause a system crash. The issue occurs when the system handles specific types of secure network connections (TCP-AO), leading to a memory error that destabilizes the operating system. This could result in a denial-of-service, impacting the availability of servers and connected services.
Technical details
A use-after-free vulnerability exists in the Linux kernel's TCP Authentication Option (TCP-AO) implementation due to the premature removal of RCU grace period protections in 'tcp_ao_destroy_sock'. When a socket is in the TCP_SYN_SENT state, it is already discoverable in the global ehash table. A remote attacker can trigger a race condition by sending forged TCP-AO segments that are processed in softirq context on one CPU while the socket is being destroyed on another. Because the 'ao_info' structure is freed synchronously without waiting for an RCU grace period, the reader path in '__tcp_ao_do_lookup' may attempt to access memory that has already been freed or reused, leading to a general protection fault. The issue has been resolved by restoring the 'call_rcu' callback to ensure memory is only freed after all readers have finished.
Affected products
- Linux Linux Kernel v6.18 to v7.1-rc2
Timeline
- 2026-06-25: disclosed: Initial patch submission
- 2026-07-18: patched: Commits applied to stable branches
- 2026-07-25: advisory: CVE published in NVD