CVE-2026-80850

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix AO info use-after-free in tcp_ao_connect_init()

tcp_v4_connect() adds a SYN-SENT socket to the ehash before calling

tcp_connect(). If TCP-AO is configured, tcp_connect() first verifies that

a key matches the peer and the bound device's current L3 master.

tcp_ao_connect_init() later resolves the L3 master again and removes keys

which do not match it.

The socket lock does not stabilize the bound device's VRF membership.

Detaching the device from its VRF between the initial validation and the

L3-master calculation in tcp_ao_connect_init() can therefore make the

validation succeed while initialization observes the default L3 domain and

removes the only key. The subsequent AO lookup then fails, so the no-key

path clears tp->ao_info and frees it directly.

The receive path can find the socket in the ehash and load tp->ao_info

under RCU before acquiring the socket lock. A reader which loaded the old

pointer can

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References