SB2026072159 - Use-after-free in Linux kernel ipv4

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-53389)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a use-after-free in tcp_ao_delete_key() in net/ipv4/tcp_ao.c when deleting a TCP-AO key asynchronously and later querying TCP_AO_INFO. A local user can delete a key with del_async enabled after setting it as the current or rnext key to disclose sensitive information.

The issue occurs when a key was assigned as the current or rnext key while the socket was in CLOSE state and the socket is later transitioned to LISTEN.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/5ba9950bc9078e19b69cca1e56d1553b125c6857
• https://git.kernel.org/stable/c/6ce7ef41743740ce15c2061561b784148b565b3f
• https://git.kernel.org/stable/c/7ddc29a094d96e9b3aa280433c6dc443df9eabf2
• https://git.kernel.org/stable/c/e77fbefd1269b5c123e7c651a1ebdce1b87d19a0