CVE-2026-80849: Linux Kernel TCP-AO Use-After-Free Vulnerability

CVE-2026-80849 Overview

CVE-2026-80849 is a use-after-free vulnerability in the Linux kernel's TCP Authentication Option (TCP-AO) implementation. The flaw resides in the net/tcp-ao subsystem and affects the handling of the current_key pointer when a socket is disconnected and reconnected to a different peer. A softirq entering the fast path while the socket is still established can update current_key to point at a key that is subsequently freed by call_rcu() during tcp_ao_connect_init(). The next call to tcp_ao_transmit_skb() then reads the traffic key from freed memory.

Critical Impact
The use-after-free condition in tcp_inbound_ao_hash() can lead to kernel memory corruption, potential information disclosure, or denial of service on systems using TCP-AO for authenticated TCP sessions such as BGP peering.

Affected Products

Linux kernel versions containing the TCP-AO implementation prior to the referenced fix commits
Distributions shipping kernels with net/tcp-ao support enabled
Systems using TCP-AO for RFC 5925 authenticated TCP sessions (commonly BGP routers and infrastructure)

Discovery Timeline

2026-09-04 - CVE-2026-80849 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80849

Vulnerability Analysis

The vulnerability affects the Linux kernel TCP Authentication Option (TCP-AO) code path used to authenticate segments on established TCP connections. tcp_inbound_ao_hash() executes before bh_lock_sock_nested() acquires the socket lock, holding only rcu_read_lock(). On the fast path for established sockets, if the rnext_keyid sent by the peer differs from current_key->sndid, the requested key is looked up and stored in current_key. The lookup runs inside an RCU read-side critical section, but current_key outlives that section.

When the socket is disconnected and connect() is called for another peer, tcp_ao_connect_init() unlinks every key that does not match the new peer and frees it with call_rcu(). A concurrent softirq that entered the fast path while the socket was still established can update current_key after the state check has run. Because the update occurs inside the RCU read side, it precedes the call_rcu() callback. Once the callback frees the key, current_key references freed memory, and the next transmission dereferences it in tcp_get_current_key().

Root Cause

The root cause is a missing synchronization between the RCU-protected fast path that promotes a key into current_key and the reconnect path that unlinks and frees keys not matching the new peer. current_key is a bare pointer that outlives the RCU read-side critical section performing the assignment, so an RCU grace period alone does not protect it once the socket transitions to a new peer.

Attack Vector

An attacker capable of triggering incoming TCP-AO segments to a socket during a narrow window around socket reconnection can race the softirq receive path against the connect path. Successful exploitation requires precise timing between an inbound segment carrying a differing rnext_keyid and a local connect() call that reassigns the socket to a new peer. The outcome is a dangling current_key pointer that is dereferenced on the next transmit, producing a kernel use-after-free.

The upstream fix waits for one RCU grace period before unlinking keys, and only when a key is actually going to be removed. By the time tcp_connect() runs, the socket is already in TCP_SYN_SENT, which is not included in TCP_AO_ESTABLISHED. This ensures that no softirq entering after the wait can reach the fast path, and any softirqs already in it have finished. The existing NULL handling in the loop then covers the remaining cases. See the kernel commit da4471557f and related fix commits for the implementation details.

Detection Methods for CVE-2026-80849

Indicators of Compromise

Unexpected kernel oops or panic messages referencing tcp_ao_transmit_skb, tcp_get_current_key, or tcp_inbound_ao_hash
KASAN reports flagging use-after-free in the net/ipv4/tcp_ao.c or net/ipv6/tcp_ao.c code paths
Sporadic TCP-AO authentication failures on long-lived sessions immediately following socket reconnection to a different peer

Detection Strategies

Enable CONFIG_KASAN in test and staging kernels to surface use-after-free access in the TCP-AO code paths under load
Correlate kernel crash telemetry with BGP or other TCP-AO consumers performing peer reconnections
Compare running kernel versions against the fixed commits listed in the upstream references to identify unpatched hosts

Monitoring Recommendations

Aggregate kernel logs (dmesg, journalctl -k) centrally and alert on stack traces referencing TCP-AO functions
Track kernel package versions across the fleet and flag hosts running kernels earlier than the stable releases carrying the fix
Monitor BGP session flaps and TCP-AO authentication counters exposed via ss --tcp-ao for anomalies

How to Mitigate CVE-2026-80849

Immediate Actions Required

Apply vendor kernel updates that include the fix commits referenced by the upstream Linux stable tree
Prioritize patching hosts that terminate BGP or other TCP-AO authenticated sessions
Reboot patched systems to load the corrected kernel image

Patch Information

The fix is available in the upstream Linux kernel via multiple stable branch commits: 2857dcbd03c, 73fde8fe44, 84a93b4e01, da4471557f, and e54ad693ed. The patch introduces an RCU grace period wait before unlinking keys during reconnection, ensuring in-flight softirqs on the fast path complete before any key is freed.

Workarounds

If patching cannot be scheduled immediately, avoid reconnecting TCP-AO sockets to different peers on the same socket instance where feasible
Restrict administrative access that can trigger reconnection sequences on TCP-AO enabled services
Limit exposure of TCP-AO endpoints to trusted network segments while patch deployment is planned

bash

# Verify the running kernel version and compare against fixed stable releases
uname -r

# Inspect kernel logs for TCP-AO related crashes
dmesg -T | grep -iE 'tcp_ao|use-after-free|KASAN'

# List active TCP-AO keys on a socket (requires recent iproute2)
ss --tcp-ao