CVE-2026-80849

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/tcp-ao: fix use-after-free of current_key on reconnect to another peer

tcp_inbound_ao_hash() is called before bh_lock_sock_nested() is taken,

with only rcu_read_lock() held. On the fast path for established

sockets, if the rnext_keyid sent by the peer differs from

current_key->sndid, the key the peer asked for is looked up and stored

in current_key. The lookup is inside the RCU read side, but current_key

outlives it.

When the socket is disconnected and connect() is called again for

another peer, tcp_ao_connect_init() unlinks every key that does not

match the new peer and frees it with call_rcu(). If current_key points

at such a key, it is cleared to NULL.

The fast path reads sk_state only once on entry, so a softirq that got

into it while the socket was still established can update current_key

after that loop has already run. The update is inside the RCU read side,

so it comes before the call_rcu() callback, an

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References