CVE-2026-53389 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
net/tcp-ao: fix use-after-free of key in del_async path
In tcp_ao_delete_key(), the del_async path skips the current_key and rnext_key validity checks present in the synchronous path, assuming these pointers are always NULL on LISTEN sockets. However, if a key was added with set_current=1/set_rnext=1 while the socket was in CLOSE state, current_key and rnext_key will be non-NULL after listen() transitions the socket to LISTEN.
When such a key is deleted with del_async=1, hlist_del_rcu() and call_rcu() free the key without clearing the dangling pointers. After the RCU grace period, getsockopt(TCP_AO_INFO) dereferences current_key->sndid and rnext_key->rcvid from freed slab memory.
Clear current_key and rnext_key in the del_async path when they reference the key being deleted.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability exists within the Linux kernel's TCP Authentication Option implementation, specifically affecting the tcp_ao_delete_key function. The issue stems from an inconsistent handling of key deletion between synchronous and asynchronous execution paths, creating a use-after-free condition that can lead to system instability and potential privilege escalation. The flaw occurs when processing TCP AO (Authentication Option) keys during socket state transitions, particularly involving LISTEN sockets.
The technical root cause involves a missing validation check in the asynchronous deletion path of the TCP AO subsystem. During normal operation, when a socket transitions from CLOSE to LISTEN state, keys that were previously marked with set_current=1 or set_rnext=1 retain their references. However, the del_async code path fails to validate whether current_key and rnext_key pointers are valid before attempting deletion operations. This assumption breaks down when these pointers legitimately contain non-NULL values after socket state changes, leading to improper memory management during key removal.
The operational impact of this vulnerability manifests through a classic use-after-free scenario where the RCU (Read-Copy-Update) framework frees kernel memory containing TCP AO key structures without properly clearing the dangling references. When subsequent getsockopt(TCP_AO_INFO) calls attempt to access freed memory locations, specifically current_key->sndid and rnext_key->rcvid fields, the system experiences undefined behavior including potential kernel crashes or data corruption. This vulnerability affects systems running Linux kernels with TCP AO support, particularly those handling network connections with authentication options.
The fix implements proper pointer clearing in the asynchronous deletion path by ensuring that current_key and rnext_key are explicitly set to NULL when they reference the key being deleted. This prevents subsequent access to freed memory locations while maintaining the integrity of the TCP AO subsystem. The vulnerability aligns with CWE-416 (Use After Free) and can be categorized under ATT&CK technique T1059.003 (Scripting) in contexts where exploitation might involve crafting malicious network traffic to trigger the race condition, though direct exploitation typically requires kernel-level access or specific system configurations.
Security implications extend beyond immediate crash potential to include possible information disclosure through memory corruption and privilege escalation opportunities if attackers can control the timing of socket state transitions. The vulnerability affects all Linux kernel versions implementing TCP AO functionality, with particular risk in network services handling multiple concurrent connections where socket state changes occur frequently. Mitigation strategies include applying kernel patches that correct the pointer validation logic and implementing proper kernel version management to ensure systems remain protected against this memory safety issue.