Loading vulnerability…
Use-After-Free in Linux Kernel tcp_ao_connect_init
A use-after-free vulnerability exists in the Linux kernel's tcp_ao_connect_init function. The issue arises because call_rcu is invoked outside of an RCU read-side critical section during an hlist_for_each_entry_rcu traversal, allowing the RCU grace period to elapse and the key to be freed while still in use. This can result in dereferencing a freed object.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation of this vulnerability could allow an attacker to trigger a use-after-free condition, potentially leading to kernel memory corruption, privilege escalation, or denial of service. The exact impact depends on the attacker's ability to control or predict the freed memory's contents.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, restrict untrusted access to the affected system and monitor for abnormal kernel behavior. There are no known effective mitigations short of applying the patch.
Patch, then assume compromise.
Upgrade to a Linux kernel version that includes the fix, which changes the traversal to use hlist_for_each_entry_safe, ensuring safe iteration even if elements are removed during traversal.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.