CVE-2026-80849: net/tcp-ao: fix use-after-free of current_key on reconnect to another peer

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net/tcp-ao: fix use-after-free of current_key on reconnect to another peer

tcp_inbound_ao_hash() is called before bh_lock_sock_nested() is taken,
with only rcu_read_lock() held. On the fast path for established
sockets, if the rnext_keyid sent by the peer differs from
current_key->sndid, the key the peer asked for is looked up and stored
in current_key. The lookup is inside the RCU read side, but current_key
outlives it.

When the socket is disconnected and connect() is called again for
another peer, tcp_ao_connect_init() unlinks every key that does not
match the new peer and frees it with call_rcu(). If current_key points
at such a key, it is cleared to NULL.

The fast path reads sk_state only once on entry, so a softirq that got
into it while the socket was still established can update current_key
after that loop has already run. The update is inside the RCU read side,
so it comes before the call_rcu() callback, and once the callback frees
the key, current_key is left pointing at freed memory.

The next transmission picks that pointer up in tcp_get_current_key().
tcp_ao_transmit_skb() then reads the traffic key from the freed object,
which is the use-after-free.

Wait for one grace period before unlinking, and only if a key is going
to be removed. By the time tcp_connect() runs the socket is already in
TCP_SYN_SENT, and TCP_AO_ESTABLISHED does not contain TCPF_SYN_SENT, so
a softirq entering after the wait cannot reach the fast path, and the
ones already in it have finished. The existing NULL handling in the loop
is then enough.

The Linux kernel CVE team has assigned CVE-2026-80849 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.7 with commit 0a3a809089eb1d4a0a2fd0c16b520d603988c859 and fixed in 6.12.108 with commit 84a93b4e012587d0a4a84ffb23ec6da18e9d85f9
	Issue introduced in 6.7 with commit 0a3a809089eb1d4a0a2fd0c16b520d603988c859 and fixed in 6.18.49 with commit 73fde8fe4469f4ed8f0afcc0b9d6413002a9e6b3
	Issue introduced in 6.7 with commit 0a3a809089eb1d4a0a2fd0c16b520d603988c859 and fixed in 7.1.13 with commit e54ad693eddb40c595add013f545354c538e325b
	Issue introduced in 6.7 with commit 0a3a809089eb1d4a0a2fd0c16b520d603988c859 and fixed in 7.2.3 with commit 2857dcbd03cf3354af0fba1b65c6a260fb43811a
	Issue introduced in 6.7 with commit 0a3a809089eb1d4a0a2fd0c16b520d603988c859 and fixed in 7.3-rc1 with commit da4471557f279d0f56605158a625bb6e49ef7d41

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-80849
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv4/tcp_ao.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/84a93b4e012587d0a4a84ffb23ec6da18e9d85f9
	https://git.kernel.org/stable/c/73fde8fe4469f4ed8f0afcc0b9d6413002a9e6b3
	https://git.kernel.org/stable/c/e54ad693eddb40c595add013f545354c538e325b
	https://git.kernel.org/stable/c/2857dcbd03cf3354af0fba1b65c6a260fb43811a
	https://git.kernel.org/stable/c/da4471557f279d0f56605158a625bb6e49ef7d41