{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-53389","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-06-09T07:44:35.402Z","datePublished":"2026-07-19T12:01:54.386Z","dateUpdated":"2026-08-17T04:50:40.399Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T04:50:40.399Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tcp-ao: fix use-after-free of key in del_async path\n\nIn tcp_ao_delete_key(), the del_async path skips the current_key\nand rnext_key validity checks present in the synchronous path,\nassuming these pointers are always NULL on LISTEN sockets.  However,\nif a key was added with set_current=1/set_rnext=1 while the socket\nwas in CLOSE state, current_key and rnext_key will be non-NULL\nafter listen() transitions the socket to LISTEN.\n\nWhen such a key is deleted with del_async=1, hlist_del_rcu() and\ncall_rcu() free the key without clearing the dangling pointers.\nAfter the RCU grace period, getsockopt(TCP_AO_INFO) dereferences\ncurrent_key->sndid and rnext_key->rcvid from freed slab memory.\n\nClear current_key and rnext_key in the del_async path when they\nreference the key being deleted."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local `setsockopt`/`getsockopt` syscalls on a TCP socket owned by the attacker; the UAF is triggered in socket-option management, not by remote TCP-AO packet processing on the listen path.\nAC:L - An attacker who controls the socket can deterministically perform add-with-set_current/set_rnext on CLOSE, listen(), del_async delete, wait for RCU, then getsockopt(TCP_AO_INFO) without depending on conditions outside their control.\nPR:L - No capability checks protect TCP-AO socket options beyond socket ownership; an unprivileged local user (including in a user namespace) can create a listening TCP socket, configure TCP-AO keys, and trigger the bug on their own socket.\nUI:N - No victim interaction is required; the attacker drives the full exploit sequence through their own socket file descriptor.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same security domain; this is not a cross-VM, cross-container, or IOMMU boundary escape.\nC:H - The bug is a use-after-free where `getsockopt(TCP_AO_INFO)` reads `sndid`/`rcvid` from freed `tcp_ao_key` slab memory, enabling information disclosure from attacker-influenced freed heap contents.\nI:H - Use-after-free of a heap-allocated `tcp_ao_key` structure can be leveraged with heap grooming for arbitrary memory corruption and potential kernel code execution, not merely a bounded write.\nA:H - Dereferencing freed kernel memory via `getsockopt(TCP_AO_INFO)` can cause kernel oops/panic and denial of service even when full exploitation is not attempted."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/tcp_ao.c"],"versions":[{"version":"d6732b95b6fbbc6d5bb9d2f809e275763640c4a2","lessThan":"6ce7ef41743740ce15c2061561b784148b565b3f","status":"affected","versionType":"git"},{"version":"d6732b95b6fbbc6d5bb9d2f809e275763640c4a2","lessThan":"e77fbefd1269b5c123e7c651a1ebdce1b87d19a0","status":"affected","versionType":"git"},{"version":"d6732b95b6fbbc6d5bb9d2f809e275763640c4a2","lessThan":"7ddc29a094d96e9b3aa280433c6dc443df9eabf2","status":"affected","versionType":"git"},{"version":"d6732b95b6fbbc6d5bb9d2f809e275763640c4a2","lessThan":"5ba9950bc9078e19b69cca1e56d1553b125c6857","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/tcp_ao.c"],"versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","status":"unaffected","versionType":"semver"},{"version":"6.12.95","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.38","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.3","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.95"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.18.38"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"7.1.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/6ce7ef41743740ce15c2061561b784148b565b3f"},{"url":"https://git.kernel.org/stable/c/e77fbefd1269b5c123e7c651a1ebdce1b87d19a0"},{"url":"https://git.kernel.org/stable/c/7ddc29a094d96e9b3aa280433c6dc443df9eabf2"},{"url":"https://git.kernel.org/stable/c/5ba9950bc9078e19b69cca1e56d1553b125c6857"}],"title":"net/tcp-ao: fix use-after-free of key in del_async path","x_generator":{"engine":"bippy-1.2.0"}}}}