Use-after-free in Linux kernel - CVE-2026-53389

Vulnerability identifier: #VU138883

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-53389

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a use-after-free in tcp_ao_delete_key() in net/ipv4/tcp_ao.c when deleting a TCP-AO key asynchronously and later querying TCP_AO_INFO. A local user can delete a key with del_async enabled after setting it as the current or rnext key to disclose sensitive information.

The issue occurs when a key was assigned as the current or rnext key while the socket was in CLOSE state and the socket is later transitioned to LISTEN.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-azure (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-oracle-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - addressed in versions 7.0.0-31.31, 7.0.0-31.31.1, 7.0.0-31.31~24.04.1, 7.0.0-1006.7, 7.0.0-1011.11~24.04.1, 7.0.0-1012.12, 7.0.0-1012.12~24.04.1
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1011.11, 7.0.0-1014.14
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-oracle-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1013.13
linux-azure-7.0 (Ubuntu package) - update to 7.0.0-1014.14~24.04.1

• https://git.kernel.org/stable/c/5ba9950bc9078e19b69cca1e56d1553b125c6857
• https://git.kernel.org/stable/c/6ce7ef41743740ce15c2061561b784148b565b3f
• https://git.kernel.org/stable/c/7ddc29a094d96e9b3aa280433c6dc443df9eabf2
• https://git.kernel.org/stable/c/e77fbefd1269b5c123e7c651a1ebdce1b87d19a0

• Use-after-free in Linux kernel ipv4
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux
• Ubuntu update for linux-gcp-7.0
• Ubuntu update for linux-oracle-7.0
• Ubuntu update for linux-azure
• Ubuntu update for linux-azure-7.0