Executive brief
The Linux kernel contains a use-after-free vulnerability in TCP Authentication Option (AO) handling during connection establishment. An unprivileged attacker can race VRF (Virtual Routing and Forwarding) device detachment with TCP connection setup to trigger a use-after-free condition, potentially causing a kernel crash or information disclosure. This affects systems using TCP-AO security features in virtualized or containerized environments.
Technical details
The vulnerability is a use-after-free in the TCP-AO authentication code path. When tcp_v4_connect() establishes a connection, it adds the socket to ehash before validating AO keys against the L3 master domain. A race condition between initial L3-master validation and subsequent L3-master resolution in tcp_ao_connect_init() allows an attacker to detach a veth device from its VRF between these checks. This causes the no-key path to deallocate tp->ao_info directly, but the receive path can still hold an RCU reference and access the freed memory in tcp_inbound_ao_hash(). The fix defers the free until after an RCU grace period using tcp_ao_destroy_sock(). Attack vector requires unprivileged user namespace and network namespace access to perform the VRF detach race. KASAN confirmed the issue with reproducer reaching the no-key path in 366–411 attempts per 1000 tries.
Affected products
- Linux Linux kernel Versions containing TCP-AO support prior to the fix
Timeline
- 2026-09-04: disclosed