CVE-2026-72139

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: defer md5sig_info kfree past RCU grace period in tcp_connect

The md5+ao reconciliation in tcp_connect() (net/ipv4/tcp_output.c)

has two symmetric branches:

if (needs_md5) {

tcp_ao_destroy_sock(sk, false);

} else if (needs_ao) {

tcp_clear_md5_list(sk);

kfree(rcu_replace_pointer(tp->md5sig_info, NULL, ...));

}

Both branches free a per-socket auth-info object while the socket is

in TCP_SYN_SENT and is already on the inet ehash (inserted by

inet_hash_connect() in tcp_v4_connect()). Both branches are reachable

by softirq RX-path readers that load the corresponding info pointer

via implicit RCU before bh_lock_sock_nested() is taken.

The needs_md5 branch is fixed in the prior patch by re-introducing

the call_rcu() free in tcp_ao_destroy_sock(): the equivalent per-key

loop runs inside tcp_ao_info_free_rcu(), the RCU callback, so by the

time it frees each tcp_ao_key all softirq readers that captured the

conta

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References