CVE-2026-53389

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/tcp-ao: fix use-after-free of key in del_async path

In tcp_ao_delete_key(), the del_async path skips the current_key

and rnext_key validity checks present in the synchronous path,

assuming these pointers are always NULL on LISTEN sockets. However,

if a key was added with set_current=1/set_rnext=1 while the socket

was in CLOSE state, current_key and rnext_key will be non-NULL

after listen() transitions the socket to LISTEN.

When such a key is deleted with del_async=1, hlist_del_rcu() and

call_rcu() free the key without clearing the dangling pointers.

After the RCU grace period, getsockopt(TCP_AO_INFO) dereferences

current_key->sndid and rnext_key->rcvid from freed slab memory.

Clear current_key and rnext_key in the del_async path when they

reference the key being deleted.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References