CVE-2026-64459: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64459 Overview

CVE-2026-64459 is a use-after-free vulnerability in the Linux kernel's TCP Authentication Option (TCP-AO) implementation. The flaw resides in tcp_ao_destroy_sock() in net/ipv4/tcp_ao.c, where a prior commit removed the RCU grace period before freeing tcp_ao_info structures. When tcp_connect() reconciles conflicting TCP-MD5 and TCP-AO configurations, the socket is already discoverable in the inet ehash. A concurrent softirq processing inbound segments on another CPU can dereference the freed ao_info pointer, walking attacker-controlled or poisoned memory in interrupt context.

Critical Impact
An unprivileged local user in a user namespace can trigger kernel memory corruption in softirq context, enabling denial of service and potential local privilege escalation on affected Linux kernels.

Affected Products

Linux kernel versions containing commit 51e547e8c89c ("tcp: Free TCP-AO/TCP-MD5 info/keys without RCU")
Linux kernel v7.1-rc2 confirmed vulnerable per reproducer
Distributions shipping kernels prior to the fixing commits 4caf12c778fe, 657646c08c94, and 8bc4d43bccbd

Discovery Timeline

2026-07-25 - CVE-2026-64459 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64459

Vulnerability Analysis

The vulnerability is a classic use-after-free race between the socket teardown path and softirq-driven receive processing. Commit 51e547e8c89c removed the call_rcu() callback from tcp_ao_destroy_sock() on the assumption that destruction was deferred until the socket destructor ran, when no readers could still hold references.

That assumption breaks in the tcp_connect() call site at net/ipv4/tcp_output.c:4327-4332. At that moment the socket sits in TCP_SYN_SENT and has already been inserted into the inet ehash by inet_hash_connect() inside tcp_v4_connect(). The socket is fully reachable by any CPU running tcp_v4_rcv().

A reader entering __tcp_ao_do_lookup() at net/ipv4/tcp_ao.c:208 reloads tp->ao_info through rcu_dereference_check(). Because no synchronize_rcu() sits between rcu_assign_pointer(tp->ao_info, NULL) and tcp_ao_info_free(), the reader can capture a pointer that the writer is about to free synchronously.

Root Cause

The writer's kfree() completes between the reader's pointer re-fetch at line 218 and the hlist_for_each_entry_rcu() iteration at line 223. The freed slab is either reused or stamped with LIST_POISON1, and the softirq walks that memory as if it were a valid key list. Kernel Address Sanitizer (KASAN) flags this as a wild memory access in the range [0xdead000000000178-0xdead00000000017f].

Attack Vector

An unprivileged uid=1000 process operating inside a CLONE_NEWUSER|CLONE_NEWNET namespace installs both TCP_MD5SIG and TCP_AO_ADD_KEY on a TCP socket. The attacker sprays forged TCP-AO segments toward the eventual 4-tuple through raw sockets, then invokes connect(). The MD5-wins reconciliation logic in tcp_connect() fires tcp_ao_destroy_sock() while the loopback NAPI softirq reader is still walking ao->head.first, producing a general protection fault in __tcp_ao_do_lookup+0x107/0x1c0.

See the upstream kernel commit for the full reproducer and patch context.

Detection Methods for CVE-2026-64459

Indicators of Compromise

Kernel oops messages referencing __tcp_ao_do_lookup, tcp_ao_inbound_lookup, or tcp_inbound_ao_hash in the call trace
KASAN reports of wild memory access near the LIST_POISON1 address 0xdead000000000178
General protection faults occurring in softirq context on non-canonical addresses during TCP receive processing
Unexpected kernel panics on hosts where unprivileged user namespaces are enabled

Detection Strategies

Audit installed kernel versions against the fixing commits 4caf12c778fe, 657646c08c94, and 8bc4d43bccbd
Enable KASAN on test kernels to surface the use-after-free before production exposure
Alert on repeated process creation of workloads that combine TCP_MD5SIG and TCP_AO_ADD_KEY setsockopt calls from unprivileged UIDs
Monitor kernel ring buffers via dmesg or journald for TCP-AO lookup crashes

Monitoring Recommendations

Ship kernel logs to a centralized SIEM and create rules for oops signatures involving tcp_ao symbols
Track syscall telemetry for unshare(CLONE_NEWUSER|CLONE_NEWNET) followed by raw socket creation by non-root users
Correlate host crashes with recent TCP-AO configuration activity to identify targeted exploitation attempts

How to Mitigate CVE-2026-64459

Immediate Actions Required

Apply the upstream Linux kernel patches from commits 4caf12c778fe, 657646c08c94, and 8bc4d43bccbd as soon as vendor-backported kernels are available
Restrict unprivileged user namespace creation on systems that do not require it by setting kernel.unprivileged_userns_clone=0
Disable raw socket capabilities for untrusted workloads through seccomp or capability bounding sets
Inventory workloads that legitimately use TCP-AO and prioritize their hosts for patching

Patch Information

The fix restores the RCU grace period by re-adding struct rcu_head to tcp_ao_info and replacing the synchronous tcp_ao_info_free() with a call_rcu() callback. Readers that captured tp->ao_info before rcu_assign_pointer NULLed it now observe a valid object until rcu_read_unlock(). See the Linux kernel stable commit for the authoritative patch.

Workarounds

Disable TCP-AO support at kernel build time where operationally acceptable by unsetting CONFIG_TCP_AO
Block unprivileged user namespace creation via sysctl to prevent the primary exploitation path
Apply seccomp profiles to container runtimes that deny setsockopt calls for TCP_MD5SIG and TCP_AO_ADD_KEY from untrusted tenants

bash

# Disable unprivileged user namespaces to block the reproducer path
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.d/99-cve-2026-64459.conf