CVE-2026-80849

A flaw was found in the Linux kernel's TCP Authentication Option (TCP-AO) implementation. When a network connection using TCP-AO is re-established with a different server, a timing issue can cause the system to attempt to use memory that has already been released. This 'use-after-free' vulnerability could lead to a system crash, making the system unavailable, or potentially allow an attacker to execute malicious code.

A use-after-free flaw in the Linux kernel's TCP Authentication Option (TCP-AO) implementation, rated IMPORTANT by Red Hat, affects the kernel in Red Hat Enterprise Linux 9.10. When a TCP-AO socket is disconnected and then re-connected to a different peer, a race condition allows a softirq still processing inbound TCP-AO traffic to update the socket's current_key pointer to a key that tcp_ao_connect_init() has already unlinked and scheduled for freeing. The next transmission then reads the traffic key from the freed memory, which can crash the kernel (kernel panic) and, in the worst case, allow execution of malicious code. Exploitation requires local access to re-connect an existing TCP-AO socket to another peer and is difficult to trigger reliably (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Within the Red Hat portfolio, only the RHEL 9.10 kernel and kernel-rt packages are affected, and a fix is being pursued for that stream; all other Red Hat Enterprise Linux streams, Red Hat In-Vehicle OS, and OpenShift Container Platform releases are not affected because the vulnerable code is not present in their shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.