CVE-2026-64459

A flaw was found in the Linux kernel's TCP-AO (TCP Authentication Option) implementation. An unprivileged local user can exploit a use-after-free vulnerability in the tcp_ao_destroy_sock() function. By manipulating TCP sockets with TCP_MD5SIG and TCP_AO_ADD_KEY, an attacker can trigger a race condition during socket connection. This can lead to a system crash, resulting in a Denial of Service (DoS).