CVE-2026-53389

In the Linux kernel, the following vulnerability has been resolved:

net/tcp-ao: fix use-after-free of key in del_async path

In tcpaodeletekey(), the delasync path skips the currentkey and rnextkey validity checks present in the synchronous path, assuming these pointers are always NULL on LISTEN sockets. However, if a key was added with setcurrent=1/setrnext=1 while the socket was in CLOSE state, currentkey and rnextkey will be non-NULL after listen() transitions the socket to LISTEN.

When such a key is deleted with delasync=1, hlistdelrcu() and callrcu() free the key without clearing the dangling pointers. After the RCU grace period, getsockopt(TCPAOINFO) dereferences currentkey->sndid and rnextkey->rcvid from freed slab memory.

Clear currentkey and rnextkey in the del_async path when they reference the key being deleted.