CVE-2026-53389: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53389 Overview

CVE-2026-53389 is a use-after-free vulnerability in the Linux kernel's TCP Authentication Option (TCP-AO) subsystem. The flaw resides in the tcp_ao_delete_key() function within net/ipv4/tcp_ao.c. The asynchronous deletion path (del_async) skips validity checks that the synchronous path performs on current_key and rnext_key pointers.

When a TCP-AO key is added with set_current=1/set_rnext=1 while the socket is in CLOSE state and later transitions to LISTEN, these pointers remain non-NULL. Deleting that key with del_async=1 frees the memory without clearing the dangling pointers, leaving stale references that are dereferenced by getsockopt(TCP_AO_INFO) after the RCU grace period.

Critical Impact
A local attacker with CAP_NET_ADMIN capability can trigger use-after-free of slab memory, leading to kernel information disclosure, memory corruption, or local privilege escalation.

Affected Products

Linux kernel versions with TCP-AO (TCP Authentication Option) support enabled
Distributions shipping vulnerable kernels prior to the referenced stable commits
Systems using TCP-AO for BGP or similar authenticated TCP sessions

Discovery Timeline

2026-07-19 - CVE-2026-53389 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-53389

Vulnerability Analysis

The vulnerability is a use-after-free condition in the Linux kernel TCP-AO key management logic. TCP-AO (RFC 5925) provides cryptographic authentication for long-lived TCP connections and maintains per-socket key state, including current_key (used for outgoing segments) and rnext_key (advertised as the receiver's next key).

The synchronous key deletion path in tcp_ao_delete_key() validates whether the key being removed is referenced by current_key or rnext_key before releasing it. The asynchronous path assumes those pointers cannot reference active keys on LISTEN sockets and skips the check. This assumption is incorrect.

Root Cause

When userspace adds a TCP-AO key with set_current=1 and set_rnext=1 while the socket is in CLOSE state, both pointers are populated. A subsequent listen() call transitions the socket to LISTEN without resetting the pointers. Calling setsockopt(TCP_AO_DEL_KEY) with del_async=1 then invokes hlist_del_rcu() and call_rcu() to free the key, leaving current_key and rnext_key pointing to freed slab memory.

After the RCU grace period elapses, any read via getsockopt(TCP_AO_INFO) dereferences current_key->sndid and rnext_key->rcvid from the freed allocation, producing a classic use-after-free [CWE-416].

Attack Vector

Exploitation requires local access with CAP_NET_ADMIN on a network namespace and the ability to create TCP sockets with TCP-AO configured. The attacker programs a key while the socket is in CLOSE, transitions to LISTEN, issues an asynchronous delete, then triggers a getsockopt(TCP_AO_INFO) read. Successful exploitation can leak kernel memory contents or, when the freed slab object is reallocated with attacker-controlled data, corrupt kernel state.

The fix, applied in stable commits 5ba9950, 6ce7ef4, 7ddc29a, and e77fbef, clears current_key and rnext_key in the del_async path when they reference the key being deleted. Details are available in the Kernel Git Commit 5ba9950 and companion patches.

Detection Methods for CVE-2026-53389

Indicators of Compromise

Kernel oops or panic messages referencing tcp_ao_delete_key, tcp_ao_info_pkey_get, or slab freelist corruption in dmesg
KASAN reports flagging use-after-free reads in net/ipv4/tcp_ao.c when TCP-AO instrumentation is enabled
Unexpected process crashes or privilege escalation events on hosts running BGP daemons or other TCP-AO consumers

Detection Strategies

Inventory hosts running kernels with CONFIG_TCP_AO=y and audit which service accounts hold CAP_NET_ADMIN
Enable KASAN on test kernels to surface use-after-free conditions in the TCP-AO code path during CI runs
Correlate setsockopt syscall telemetry with TCP_AO_ADD_KEY, TCP_AO_DEL_KEY, and TCP_AO_INFO operations issued by non-standard processes

Monitoring Recommendations

Alert on kernel log entries containing BUG:, KASAN:, or general protection fault combined with TCP-AO symbol names
Track loading of the TCP-AO subsystem on servers that do not require it and flag anomalies
Monitor auditd records for processes acquiring CAP_NET_ADMIN that are not part of the approved baseline

How to Mitigate CVE-2026-53389

Immediate Actions Required

Apply the upstream fix by updating to a kernel that includes commits 5ba9950, 6ce7ef4, 7ddc29a, or e77fbef from the stable tree
Rebuild or update distribution kernels once vendors ship patched packages, then reboot affected hosts
Restrict CAP_NET_ADMIN to trusted service accounts and remove it from unprivileged workloads

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Relevant commits: Kernel Git Commit 5ba9950, Kernel Git Commit 6ce7ef4, Kernel Git Commit 7ddc29a, and Kernel Git Commit e77fbef. The patch clears current_key and rnext_key in the asynchronous delete path when they reference the freed key.

Workarounds

Disable TCP-AO on hosts that do not require RFC 5925 authentication by building kernels without CONFIG_TCP_AO
Avoid programming TCP-AO keys with set_current=1/set_rnext=1 before transitioning sockets to LISTEN, and prefer synchronous key deletion until patched kernels are deployed
Constrain access to TCP-AO management interfaces using seccomp or namespace isolation for daemons that expose them

bash

# Verify kernel version and confirm the patch is present
uname -r
grep -E 'CONFIG_TCP_AO' /boot/config-$(uname -r)

# Enumerate processes holding CAP_NET_ADMIN
getpcaps $(pgrep -d, .) 2>/dev/null | grep -i net_admin