CVE-2026-64459

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the TCP implementation where the RCU (Read-Copy-Update) grace period was incorrectly removed from the tcp ao destroy sock() function. This occurs specifically during the tcp connect() call site when a socket is in the TCP SYN SENT state and has been inserted into the inet ehash. A concurrent softirq running tcp v4 rcv() on another CPU can load the tp->ao info variable via implicit RCU before the destroying CPU takes the lock. Because there is no synchronization between nulling the pointer and freeing the memory in tcp ao destroy sock(), the reader path in tcp ao do lookup() may access a pointer to memory that has already been freed. This can lead to a general protection fault or wild-memory-access when the system iterates through the ao->head list in a softirq context, potentially allowing the iteration to walk attacker-controlled or poison memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.