CVE-2026-64459

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: restore RCU grace period in tcp_ao_destroy_sock

Commit 51e547e8c89c ("tcp: Free TCP-AO/TCP-MD5 info/keys without RCU")

removed the call_rcu() callback from tcp_ao_destroy_sock(), arguing that

"the destruction of info/keys is delayed until the socket destructor"

and therefore "no one can discover it anymore".

That argument does not hold for the call site in tcp_connect()

(net/ipv4/tcp_output.c:4327-4332). At that point the socket is in

TCP_SYN_SENT, has already been inserted into the inet ehash by

inet_hash_connect() in tcp_v4_connect(), and is therefore very much

discoverable: any softirq running tcp_v4_rcv() on another CPU can take

the socket out of the ehash, walk into tcp_inbound_hash(), and load

tp->ao_info via implicit RCU before bh_lock_sock_nested() is taken on

the destroying CPU.

The reader path then enters __tcp_ao_do_lookup() (net/ipv4/tcp_ao.c:208)

which re-loads tp->ao_info via rcu_dereference_chec

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References