CVE-2026-80850

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the TCP Authentication Option (TCP-AO) implementation. A race condition occurs when a device is detached from its Virtual Routing and Forwarding (VRF) membership between the initial validation in tcp connect() and the L3-master calculation in tcp ao connect init(). This can lead to the tp->ao info being cleared and freed directly. Simultaneously, the receive path may load the tp->ao info pointer under Read-Copy-Update (RCU) before acquiring the socket lock, allowing a reader to access the freed memory in the tcp inbound ao hash() function. This was demonstrated by an unprivileged user in network namespaces racing connect() with veth detachment.

Recommendations Use the tcp ao destroy sock() function for the no-key path to unpublish AO info and defer the free until after an RCU grace period. Remove the WARN ON ONCE() call to prevent kernel panics on systems configured with panic on warn.