CVE-2026-64459 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
tcp: restore RCU grace period in tcp_ao_destroy_sock
Commit 51e547e8c89c ("tcp: Free TCP-AO/TCP-MD5 info/keys without RCU") removed the call_rcu() callback from tcp_ao_destroy_sock(), arguing that "the destruction of info/keys is delayed until the socket destructor" and therefore "no one can discover it anymore".
That argument does not hold for the call site in tcp_connect() (net/ipv4/tcp_output.c:4327-4332). At that point the socket is in TCP_SYN_SENT, has already been inserted into the inet ehash by inet_hash_connect() in tcp_v4_connect(), and is therefore very much discoverable: any softirq running tcp_v4_rcv() on another CPU can take the socket out of the ehash, walk into tcp_inbound_hash(), and load tp->ao_info via implicit RCU before bh_lock_sock_nested() is taken on the destroying CPU.
The reader path then enters __tcp_ao_do_lookup() (net/ipv4/tcp_ao.c:208) which re-loads tp->ao_info via rcu_dereference_check(); the re-load can still observe the (about-to-be-freed) pointer because there is no synchronize_rcu() between rcu_assign_pointer(tp->ao_info, NULL) and tcp_ao_info_free() in tcp_ao_destroy_sock(). The captured pointer is then walked at line 223:
hlist_for_each_entry_rcu(key, &ao->head, node, ...)
The writer's synchronous kfree() is free to complete between the line 218 re-fetch and the line 223 hlist iteration. The slab is reused (or simply LIST_POISON1-stamped if not yet reused) and the iteration walks attacker-controlled or poison memory in softirq context.
Reproducer (no debug shim, stock x86_64 v7.1-rc2 SMP+KASAN, QEMU+KVM): an unprivileged uid=1000 process inside CLONE_NEWUSER|CLONE_NEWNET installs TCP_MD5SIG + TCP_AO_ADD_KEY on a TCP socket, sprays forged TCP-AO segments toward its eventual 4-tuple via raw sockets, then calls connect(). The md5-wins reconciliation in tcp_connect() fires tcp_ao_destroy_sock(); the softirq backlog reader on the loopback NAPI path crashes on the freed ao->head.first walk:
Oops: general protection fault, probably for non-canonical address 0xfbd59c000000002f KASAN: maybe wild-memory-access in range [0xdead000000000178-0xdead00000000017f]
CPU: 0 UID: 1000 PID: 100 Comm: repro_userns RIP: 0010:__tcp_ao_do_lookup+0x107/0x1c0 Call Trace: <IRQ> __tcp_ao_do_lookup+0x107/0x1c0 tcp_ao_inbound_lookup.constprop.0+0x12a/0x200 tcp_inbound_ao_hash+0x5ea/0x1520 tcp_inbound_hash+0x7ce/0x1240 tcp_v4_rcv+0x1e7a/0x3e10 ...
Restore the RCU grace period: re-add struct rcu_head to tcp_ao_info and replace the synchronous tcp_ao_info_free() with a call_rcu() callback. Readers that captured tp->ao_info before rcu_assign_pointer NULLed it now see the object remain valid until rcu_read_unlock(). With the patch applied the reproducer runs cleanly for 2000 iterations on the same kernel build.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability described in this CVE involves a race condition within the Linux TCP implementation, specifically affecting the handling of TCP-AO (Authenticated Options) and TCP-MD5 security options. The flaw stems from improper RCU (Read-Copy-Update) synchronization during socket destruction, creating a window where memory access violations can occur. This issue is particularly dangerous in multi-threaded environments where softirqs may concurrently process incoming packets while a socket is being torn down.
The technical root cause lies in the function tcp_ao_destroy_sock(), which previously removed a call_rcu() callback that was intended to ensure proper synchronization before freeing TCP-AO information structures. The original commit attempted to justify this removal by claiming that since the destruction occurs during socket teardown, no one could access the data anymore. However, this reasoning fails because at the point of tcp_connect() execution, the socket is already in the ehash table and accessible to other CPUs running tcp_v4_rcv(). This creates a clear window where readers can observe a stale pointer to ao_info before it is fully freed.
The operational impact becomes evident when an attacker constructs malicious TCP-AO segments and initiates a connection. During the connection process, tcp_connect() triggers tcp_ao_destroy_sock(), but due to missing RCU grace periods, softirq handlers running on other CPUs can still access the freed memory structures. The vulnerability manifests in __tcp_ao_do_lookup() where an hlist iteration walks through what should be a freed list head, leading to memory corruption and potential kernel crashes.
This flaw maps directly to CWE-367, which describes Time-of-Check to Time-of-Use (TOCTOU) vulnerabilities that arise from improper synchronization between resource access and resource deallocation. The vulnerability also aligns with ATT&CK technique T1059.007 for kernel-level code execution and T1595.001 for network protocol manipulation, as it allows for controlled memory corruption through crafted TCP packets.
The recommended mitigation involves restoring proper RCU synchronization by reintroducing the rcu_head structure to tcp_ao_info and replacing synchronous memory deallocation with asynchronous call_rcu() callbacks. This ensures that readers who previously accessed the ao_info pointer remain valid until all RCU read-side critical sections complete, preventing access to freed memory. The fix maintains the same functional behavior while adding necessary synchronization primitives that prevent the race condition between writers (socket destruction) and readers (softirq packet processing).
The vulnerability demonstrates a classic case of improper memory management in kernel space where the timing of resource deallocation creates exploitable conditions. The reproducer clearly shows how an unprivileged user can trigger this through crafted raw socket traffic, making it particularly concerning for systems that rely on TCP-AO security features. The fix ensures that all RCU readers observe consistent state transitions and prevents memory corruption scenarios that could lead to privilege escalation or system instability.
This specific vulnerability represents a failure in the kernel's memory management protocols and highlights the critical importance of proper synchronization mechanisms when dealing with shared data structures accessed from both interrupt contexts and process contexts. The restored RCU grace period ensures that all concurrent readers have completed their access before memory is freed, providing the necessary temporal separation to prevent the observed crashes and memory corruption patterns.