CVE-2026-72139

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the TCP implementation during MD5 and TCP Authentication Option (TCP-AO) reconciliation. In the tcp connect() function (located in net/ipv4/tcp output.c), the needs ao branch calls tcp clear md5 list() and kfree() to release authentication information while the socket is in the TCP SYN SENT state and present on the inet ehash. Because these objects are accessed by softirq RX-path readers via implicit Read-Copy-Update (RCU), a race condition occurs. Specifically, concurrent readers in tcp md5 do lookup() and tcp md5 do lookup exact() may attempt to access the tcp md5sig key list while it is being freed by a bare kfree(), leading to a per-key slab use-after-free. RCU is a synchronization mechanism that allows multiple readers to access data while it is being updated by a single writer, ensuring that readers see a consistent version of the data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.