Executive brief
The Linux kernel's TCP Authentication Option (TCP-AO) implementation contains a memory safety bug that can occur when a socket reconnects to a different peer. A freed memory pointer is retained and accessed during subsequent packet transmission, potentially leading to kernel crash or data corruption on systems using TCP-AO for authenticated connections.
Technical details
The vulnerability is a use-after-free in the TCP-AO implementation, specifically in the current_key pointer management across socket reconnection. The root cause is a race condition: tcp_inbound_ao_hash() reads and updates current_key under RCU read-side protection only, but the pointer persists after the RCU critical section ends. When a socket reconnects to a different peer, tcp_ao_connect_init() unlinks and frees keys for the old peer via call_rcu(). If a softirq is concurrently in the TCP-AO fast path, it can update current_key after the socket state check but before RCU grace period completion, leaving current_key pointing to freed memory. On the next transmission, tcp_get_current_key() retrieves the dangling pointer and tcp_ao_transmit_skb() accesses the freed key, causing use-after-free. The fix adds an explicit grace period wait before unlinking keys, ensuring all in-flight softirq execution completes before memory is freed.
Affected products
- Linux Linux kernel <unknown>
Timeline
- 2026-09-04: disclosed