CVE-2026-80849 (GCVE-0-2026-80849)
Vulnerability from cvelistv5
Published
2026-09-04 15:54
Modified
2026-10-19 08:44
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free of current_key on reconnect to another peer tcp_inbound_ao_hash() is called before bh_lock_sock_nested() is taken, with only rcu_read_lock() held. On the fast path for established sockets, if the rnext_keyid sent by the peer differs from current_key->sndid, the key the peer asked for is looked up and stored in current_key. The lookup is inside the RCU read side, but current_key outlives it. When the socket is disconnected and connect() is called again for another peer, tcp_ao_connect_init() unlinks every key that does not match the new peer and frees it with call_rcu(). If current_key points at such a key, it is cleared to NULL. The fast path reads sk_state only once on entry, so a softirq that got into it while the socket was still established can update current_key after that loop has already run. The update is inside the RCU read side, so it comes before the call_rcu() callback, and once the callback frees the key, current_key is left pointing at freed memory. The next transmission picks that pointer up in tcp_get_current_key(). tcp_ao_transmit_skb() then reads the traffic key from the freed object, which is the use-after-free. Wait for one grace period before unlinking, and only if a key is going to be removed. By the time tcp_connect() runs the socket is already in TCP_SYN_SENT, and TCP_AO_ESTABLISHED does not contain TCPF_SYN_SENT, so a softirq entering after the wait cannot reach the fast path, and the ones already in it have finished. The existing NULL handling in the loop is then enough.
References
Impacted products
Vendor Product Version
Linux Linux Version: 0a3a809089eb1d4a0a2fd0c16b520d603988c859
Version: 0a3a809089eb1d4a0a2fd0c16b520d603988c859
Version: 0a3a809089eb1d4a0a2fd0c16b520d603988c859
Version: 0a3a809089eb1d4a0a2fd0c16b520d603988c859
Version: 0a3a809089eb1d4a0a2fd0c16b520d603988c859
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_ao.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "84a93b4e012587d0a4a84ffb23ec6da18e9d85f9",
              "status": "affected",
              "version": "0a3a809089eb1d4a0a2fd0c16b520d603988c859",
              "versionType": "git"
            },
            {
              "lessThan": "73fde8fe4469f4ed8f0afcc0b9d6413002a9e6b3",
              "status": "affected",
              "version": "0a3a809089eb1d4a0a2fd0c16b520d603988c859",
              "versionType": "git"
            },
            {
              "lessThan": "e54ad693eddb40c595add013f545354c538e325b",
              "status": "affected",
              "version": "0a3a809089eb1d4a0a2fd0c16b520d603988c859",
              "versionType": "git"
            },
            {
              "lessThan": "2857dcbd03cf3354af0fba1b65c6a260fb43811a",
              "status": "affected",
              "version": "0a3a809089eb1d4a0a2fd0c16b520d603988c859",
              "versionType": "git"
            },
            {
              "lessThan": "da4471557f279d0f56605158a625bb6e49ef7d41",
              "status": "affected",
              "version": "0a3a809089eb1d4a0a2fd0c16b520d603988c859",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_ao.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.108",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.49",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.13",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.3",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tcp-ao: fix use-after-free of current_key on reconnect to another peer\n\ntcp_inbound_ao_hash() is called before bh_lock_sock_nested() is taken,\nwith only rcu_read_lock() held. On the fast path for established\nsockets, if the rnext_keyid sent by the peer differs from\ncurrent_key-\u003esndid, the key the peer asked for is looked up and stored\nin current_key. The lookup is inside the RCU read side, but current_key\noutlives it.\n\nWhen the socket is disconnected and connect() is called again for\nanother peer, tcp_ao_connect_init() unlinks every key that does not\nmatch the new peer and frees it with call_rcu(). If current_key points\nat such a key, it is cleared to NULL.\n\nThe fast path reads sk_state only once on entry, so a softirq that got\ninto it while the socket was still established can update current_key\nafter that loop has already run. The update is inside the RCU read side,\nso it comes before the call_rcu() callback, and once the callback frees\nthe key, current_key is left pointing at freed memory.\n\nThe next transmission picks that pointer up in tcp_get_current_key().\ntcp_ao_transmit_skb() then reads the traffic key from the freed object,\nwhich is the use-after-free.\n\nWait for one grace period before unlinking, and only if a key is going\nto be removed. By the time tcp_connect() runs the socket is already in\nTCP_SYN_SENT, and TCP_AO_ESTABLISHED does not contain TCPF_SYN_SENT, so\na softirq entering after the wait cannot reach the fast path, and the\nones already in it have finished. The existing NULL handling in the loop\nis then enough."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:44:43.405Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/84a93b4e012587d0a4a84ffb23ec6da18e9d85f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/73fde8fe4469f4ed8f0afcc0b9d6413002a9e6b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/e54ad693eddb40c595add013f545354c538e325b"
        },
        {
          "url": "https://git.kernel.org/stable/c/2857dcbd03cf3354af0fba1b65c6a260fb43811a"
        },
        {
          "url": "https://git.kernel.org/stable/c/da4471557f279d0f56605158a625bb6e49ef7d41"
        }
      ],
      "title": "net/tcp-ao: fix use-after-free of current_key on reconnect to another peer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80849",
    "datePublished": "2026-09-04T15:54:59.412Z",
    "dateReserved": "2026-08-26T14:34:25.797Z",
    "dateUpdated": "2026-10-19T08:44:43.405Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.