tcp: fix AO info use-after-free in tcp_ao_connect_init()
In the Linux kernel, the following vulnerability has been resolved: tcp: fix AO info use-after-free in tcp_ao_connect_init() tcp_v4_connect() adds a SYN-SENT socket to the ehash before calling tcp_connect(). If TCP-AO is configured, tcp_connect() first verifies that a key matches the peer and the bound device's current L3 master. tcp_ao_connect_init() later resolves the L3 master again and removes keys which do not match it. The socket lock does not stabilize the bound device's VRF membership. Detaching the device from its VRF between the initial validation and the L3-master calculation in tcp_ao_connect_init() can therefore make the validation succeed while initialization observes the default L3 domain and removes the only key. The subsequent AO lookup then fails, so the no-key path clears tp->ao_info and frees it directly. The receive path can find the socket in the ehash and load tp->ao_info under RCU before acquiring the socket lock. A reader which loaded the old pointer can thus continue into tcp_inbound_ao_hash() after the direct free. The issue was found during a static audit of TCP-AO object lifetime. An unprivileged reproducer in self-created user and network namespaces raced connect() with detaching a veth from its VRF while sending TCP-AO segments. It triggered the same KASAN report on two fresh boots: BUG: KASAN: slab-use-after-free in tcp_inbound_ao_hash+0x585/0x19f0 Write of size 8 at addr ffff88800bf88128 by task tcp_ao_vrf_race/232 Call Trace: tcp_inbound_ao_h
CVE-2026-80850
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-80850
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "248411b8cb8974a1e1c8e43123c1e682fbd64969",
"lessThan": "594ba77210a1f065832211851a2d7e14d11fcbdb",
"versionType": "git"
},
{
"status": "affected",
"version": "248411b8cb8974a1e1c8e43123c1e682fbd64969",
"lessThan": "70051a57786d5b23f059fbaf5c8241eca14d42ed",
"versionType": "git"
},
{
"status": "affected",
"version": "248411b8cb8974a1e1c8e43123c1e682fbd64969",
"lessThan": "284d7fd0eec8774bd6214921fbf525cf907c590e",
"versionType": "git"
},
{
"status": "affected",
"version": "248411b8cb8974a1e1c8e43123c1e682fbd64969",
"lessThan": "d17e88b6b60ff4ef64e0dd1444f935cb13dee1cd",
"versionType": "git"
},
{
"status": "affected",
"version": "248411b8cb8974a1e1c8e43123c1e682fbd64969",
"lessThan": "ea30dc5267e367b8a5e1e06cc074f813bcbf18b2",
"versionType": "git"
}
],
"programFiles": [
"net/ipv4/tcp_ao.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.7",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.108",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.13",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2.3",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/ipv4/tcp_ao.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-80850
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #34865 · Revision 1
- Added to Heist Feed
- Publisher date