PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53389 Linux CVE debrief

The Linux kernel was vulnerable to a use-after-free condition in the tcp_ao_delete_key() function. When a key was added with specific settings and then deleted asynchronously, the key could be freed without clearing related pointers, leading to potential crashes or code execution if the socket transitioned to LISTEN state. This vulnerability was particularly concerning because it could be triggered by specific sequences of operations on TCP Authentication Option (TCP-AO) keys, which are used to secure TCP communications. The vulnerability's impact was heightened by its potential for remote exploitation, especially in environments where untrusted parties could influence network traffic. The fix involves clearing current_key and rnext_key in the del_async path when they reference the key being deleted, ensuring that dangling pointers are not accessed after the key has been freed.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-19
Original CVE updated
2026-07-19
Advisory published
2026-07-19
Advisory updated
2026-07-19

Who should care

Linux kernel developers, administrators, and users of systems relying on the Linux kernel, especially those using TCP Authentication Option (TCP-AO) functionality, should be aware of this vulnerability. Its potential impact on network security, particularly in environments where TCP-AO is used for securing TCP communications, necessitates prompt attention. System administrators responsible for maintaining Linux-based systems, especially those exposed to untrusted networks or handling sensitive data, should prioritize patching this vulnerability. Additionally, developers working on systems that integrate with or depend on the Linux kernel should review the vulnerability details to assess potential impacts on their projects.

Technical summary

In the Linux kernel, a use-after-free vulnerability was found in the tcp_ao_delete_key() function. Specifically, when deleting a key with del_async=1, the function skipped validity checks for current_key and rnext_key, assuming they would be NULL for LISTEN sockets. However, if a key was added with set_current=1 and set_rnext=1 while the socket was in CLOSE state, these pointers could be non-NULL after the socket transitioned to LISTEN state. If such a key was then deleted asynchronously, hlist_del_rcu() and call_rcu() would free the key without clearing the dangling pointers. After the RCU grace period, getsockopt(TCP_AO_INFO) could dereference current_key->sndid and rnext_key->rcvid from freed slab memory, potentially leading to crashes or code execution.

Defensive priority

High priority for Linux kernel developers and maintainers to apply the fix. System administrators should update their kernels as soon as possible.

Recommended defensive actions

  • Apply the official kernel patch to fix the vulnerability
  • Update Linux kernel to the latest version containing the fix
  • Review system configurations and update TCP-AO settings as necessary
  • Monitor system logs for potential exploitation attempts
  • Perform a thorough review of network exposure and implement compensating controls if immediate patching is not feasible
  • Inventory assets that may be affected and prioritize patching based on risk and exposure
  • Track the deployment of patches and verify remediation through testing and monitoring

Evidence notes

The vulnerability was resolved in the Linux kernel. The fix involves clearing current_key and rnext_key in the del_async path when they reference the key being deleted. Official references are available from the Linux kernel repository.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-19T12:16:49.890Z and has not been modified since then.