Loading story…
Researchers detailed CVE-2024-27394, a Linux kernel use-after-free flaw in the TCP Authentication Option (TCP-AO) implementation, linking the bug to incorrect use of the kernel’s Read-Copy Update (RCU) synchronization model. The issue affects tcp_ao_connect_init() in net/ipv4/tcp_ao.c, where the kernel iterates over TCP-AO keys with an RCU list macro and schedules key reclamation with call_rcu() without remaining inside an RCU read-side critical section, creating a window in which a freed key can still be accessed.
The analysis showed the bug can be prepared through setsockopt(TCP_AO_ADD_KEY) and triggered during connect() on IPv4 TCP sockets, with a proof of concept reportedly reproducing the fault on Linux kernel 6.8.4 under KASAN and CONFIG_PREEMPT. Researchers said the race can be made more reliable by forcing preemption with reschedule IPIs, widening the interval between reclamation and continued iteration. The fix replaces hlist_for_each_entry_rcu with hlist_for_each_entry_safe to prevent dereferencing a freed next node, and the patch was reported as merged in April and backported to stable kernels.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Theori's analysis states that the fix for CVE-2024-27394 was patched in April and backported to stable kernels. The patch changed iteration in tcp_ao_connect_init() from hlist_for_each_entry_rcu to hlist_for_each_entry_safe.
Theori published a technical analysis of CVE-2024-27394, describing the Linux kernel TCP-AO use-after-free bug, a reliable trigger technique based on ExpRace, and a PoC reproducing the issue on Linux 6.8.4 with KASAN and CONFIG_PREEMPT enabled.
The Linux kernel project published documentation describing Read-Copy Update (RCU), the synchronization mechanism later implicated in the analyzed race condition.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2024-36904**, a seven-year-old race condition in the Linux kernel TCP subsystem that can lead to a real use-after-free involving `TIME-WAIT` sockets. The flaw was introduced by commit `ec94c2696f0b`, which changed `inet_twsk_hashdance()` so a socket could be inserted into the established hash table before its reference counter was initialized, allowing concurrent code in paths such as `tcp_twsk_unique()` and `__inet_check_established()` to observe a zero refcount and corrupt socket lifetime handling. The issue was first encountered while investigating a syzkaller report that appeared tied to KCM, but researchers determined it was unrelated and reproducible even with `CONFIG_AF_KCM` disabled. Allele Security reproduced the bug on a RHEL-derived `5.14.0-362.24.2.el9_3.x86_64` kernel and on Fedora 39 `6.8.6-200.fc39.x86_64`, where it initially manifested as refcount warnings. The researchers said Linux refcount protections usually degrade such races into leaks, but in this case a later `refcount_set()` could overwrite the saturated value and create an unbalanced reference count, enabling premature free; with a modified KASAN-enabled research kernel, they obtained an actual use-after-free report in `inet_twsk_put()`. Upstream addressed the flaw in commit `f2db7230f73a` by changing `tcp_twsk_unique()` to use `refcount_inc_not_zero()` before taking a reference to the `TIME-WAIT` socket.
Aug 20, 2026
Google Project Zero disclosed a Linux kernel vulnerability affecting **Linux `>= 6.9`** in which broken handling of **`AF_UNIX` `MSG_OOB`** traffic can trigger a **use-after-free (UAF)** condition, enabling both read and write access to freed memory. The issue was published in Project Zero's tracker as issue **`423023990`**, indicating a memory-safety flaw in the kernel's UNIX domain socket implementation rather than an application-level bug. The available references do not include a vendor advisory, patch details, CVE assignment, or exploitation evidence, but the bug title indicates potentially serious impact because kernel-level UAF read/write conditions can often be leveraged for privilege escalation or system compromise. Security teams running Linux kernels in the affected branch should monitor upstream kernel fixes and distribution backports, prioritize patch validation for systems that rely on local socket communication, and assess exposure in environments where untrusted local code execution is possible.
Jul 12, 2026
A Linux kernel vulnerability in the TLS ULP subsystem can trigger a use-after-free in `tls_sk_proto_close()` when one thread closes a TLS socket while another concurrently calls `setsockopt(SOL_TLS, TLS_TX)`. The flaw stems from a race in TLS socket teardown and state manipulation, and the original reporter said a reproducer exists, though it was mistakenly included in a public `oss-security` posting despite an intention to withhold it until a fix was available. The issue was reportedly shared with `linux-distros` before a fix had been accepted upstream, with public disclosure occurring later on `oss-security`. Follow-up discussion on the mailing list pointed to taking `lock_sock(sk)` earlier in `tls_sk_proto_close()` as the most natural mitigation because the function already acquires that lock unconditionally. Reviewers said the bug may reflect a broader locking-order problem worth auditing in similar kernel paths, and the reporter said the proposed locking change would be raised with Linux kernel networking maintainers while a fix is discussed.
Jun 29, 2026