Executive brief
The Linux kernel contains a memory safety flaw in TCP connection establishment when MD5 authentication is used. An attacker with network access can trigger a use-after-free vulnerability by racing with RCU cleanup operations, potentially leading to kernel crash, data corruption, or privilege escalation.
Technical details
This is a use-after-free vulnerability in the TCP stack's MD5 signature (md5sig) handling. The vulnerable code in tcp_connect() frees per-socket MD5 authentication info (tcp_md5sig_info container and tcp_md5sig_key entries) while the socket is already inserted in the inet ehash table and reachable by softirq RX-path readers. The race occurs because tcp_clear_md5_list() walks and frees md5sig keys with bare hlist_del + kfree, while concurrent readers in __tcp_md5_do_lookup() use RCU-safe hlist_for_each_entry_rcu(). The fix converts both the container and per-key frees to use kfree_rcu() to defer the actual memory reclaim past the RCU grace period, ensuring concurrent readers complete before keys are freed. The vulnerability is reachable during TCP connect with MD5 authentication negotiation and affects kernels with the vulnerable code path.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-08-15: disclosed