CVE-2026-53389

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the tcp ao delete key() function within the del async path. The system incorrectly assumes that current key and rnext key pointers are always NULL on LISTEN sockets. If a key is added with set current=1 or set rnext=1 while the socket is in the CLOSE state, these pointers remain non-NULL after the socket transitions to LISTEN. When the key is deleted with del async=1, the hlist del rcu() and call rcu() functions free the key without clearing the pointers. Subsequently, the getsockopt(TCP AO INFO) function dereferences current key->sndid and rnext key->rcvid from freed slab memory. RCU (Read-Copy-Update) is a synchronization mechanism that allows multiple readers to access data while it is being updated.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.