From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B3BAF4EBADF for ; Fri, 4 Sep 2026 15:57:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788537429; cv=none; b=GHfUFl8YxwX+9EnUu5IhbmcjyBhkO3J8PCrmD1EGAeB9IqSUaNUsSvc9xOvziXDwCScn/2t3/CFa70QNuUIJDJCsodlpQCarDFCDNEIZqhxP/ytKcVyVSBRjZvABZNVGQKX1MpsQXVt+azAdaXe8ub0Ka0eFvcCNzsM5uO6HYt4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788537429; c=relaxed/simple; bh=420exOHMZan8eYloGBmQlJnJmJFJPIBZbeXJx/VYLrY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=DKXMUC/i/VU5cs9mtoMLxco+RiUxp2jyruYyjx7lmMlBlMyPX/1GWIOPG42TjHzVfhjoM+aF2TPodXkcDG116RihaQeCMUFhKh2GY09JxS5s0dKdTvHpSqckwmreBshR4eNfII50RdvmcfkOeTgv6uhOZrOrNnEvm+mAOgTLfKM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JNzTWI4D; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="JNzTWI4D" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 932091F00A3D; Fri, 4 Sep 2026 15:57:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788537428; bh=RvMXrb5cjab3SyRTjPeWH20IvtEAjn/fqUV33N1GSSw=; h=From:To:Cc:Subject:Date:Reply-To; b=JNzTWI4DT8DKnScWB7vXdfaCLypGI8XzhZBURQSm2TLeQypqxm/ebEJQOxvC9+DS0 a9P/3EovcF5982XwrzB9h6A8drX0iTRugxhuJXg1YxSp9Vb8fKYaapJmWLu4xbgclt M/HqfO2FuaVlRzrkMTG2CM7cx0zFKOhlltO5bSYI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-80849: net/tcp-ao: fix use-after-free of current_key on reconnect to another peer Date: Fri, 4 Sep 2026 17:53:16 +0200 Message-ID: <2026090400-CVE-2026-80849-7113@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3967; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=yJ6Inu7UugVpbaSBnF+uGJf4deDX2bCD6jha073k9JM=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmzXsasKZJteDcjZ8ehC3/S7Ddd3RlefV7/woeof8tK1 KczL3kp2RHLwiDIxCArpsjyZRvP0f0VhxS9DG1Pw8xhZQIZwsDFKQATCbzAsGDizlNrLh96HBkr 1t3Ze0OTY69I8GmG2SxT/c7e1BbJvr/NRzL/tVlWWS/PXwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free of current_key on reconnect to another peer tcp_inbound_ao_hash() is called before bh_lock_sock_nested() is taken, with only rcu_read_lock() held. On the fast path for established sockets, if the rnext_keyid sent by the peer differs from current_key->sndid, the key the peer asked for is looked up and stored in current_key. The lookup is inside the RCU read side, but current_key outlives it. When the socket is disconnected and connect() is called again for another peer, tcp_ao_connect_init() unlinks every key that does not match the new peer and frees it with call_rcu(). If current_key points at such a key, it is cleared to NULL. The fast path reads sk_state only once on entry, so a softirq that got into it while the socket was still established can update current_key after that loop has already run. The update is inside the RCU read side, so it comes before the call_rcu() callback, and once the callback frees the key, current_key is left pointing at freed memory. The next transmission picks that pointer up in tcp_get_current_key(). tcp_ao_transmit_skb() then reads the traffic key from the freed object, which is the use-after-free. Wait for one grace period before unlinking, and only if a key is going to be removed. By the time tcp_connect() runs the socket is already in TCP_SYN_SENT, and TCP_AO_ESTABLISHED does not contain TCPF_SYN_SENT, so a softirq entering after the wait cannot reach the fast path, and the ones already in it have finished. The existing NULL handling in the loop is then enough. The Linux kernel CVE team has assigned CVE-2026-80849 to this issue. Affected and fixed versions =========================== Issue introduced in 6.7 with commit 0a3a809089eb1d4a0a2fd0c16b520d603988c859 and fixed in 6.12.108 with commit 84a93b4e012587d0a4a84ffb23ec6da18e9d85f9 Issue introduced in 6.7 with commit 0a3a809089eb1d4a0a2fd0c16b520d603988c859 and fixed in 6.18.49 with commit 73fde8fe4469f4ed8f0afcc0b9d6413002a9e6b3 Issue introduced in 6.7 with commit 0a3a809089eb1d4a0a2fd0c16b520d603988c859 and fixed in 7.1.13 with commit e54ad693eddb40c595add013f545354c538e325b Issue introduced in 6.7 with commit 0a3a809089eb1d4a0a2fd0c16b520d603988c859 and fixed in 7.2.3 with commit 2857dcbd03cf3354af0fba1b65c6a260fb43811a Issue introduced in 6.7 with commit 0a3a809089eb1d4a0a2fd0c16b520d603988c859 and fixed in 7.3-rc1 with commit da4471557f279d0f56605158a625bb6e49ef7d41 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-80849 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/ipv4/tcp_ao.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/84a93b4e012587d0a4a84ffb23ec6da18e9d85f9 https://git.kernel.org/stable/c/73fde8fe4469f4ed8f0afcc0b9d6413002a9e6b3 https://git.kernel.org/stable/c/e54ad693eddb40c595add013f545354c538e325b https://git.kernel.org/stable/c/2857dcbd03cf3354af0fba1b65c6a260fb43811a https://git.kernel.org/stable/c/da4471557f279d0f56605158a625bb6e49ef7d41