{ "cveId": "CVE-2026-64459", "url": "https://patchblox.com/security/cve/CVE-2026-64459", "summary": "CVE-2026-64459 is fixed in 20 products on 1 platform, first by ALAS2023-2026-2045, released August 3, 2026. It is not reported as exploited. Patch Radar priority: Urgent.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: tcp: restore RCU grace period in tcp_ao_destroy_...", "description": "In the Linux kernel, the following vulnerability has been resolved: tcp: restore RCU grace period in tcp_ao_destroy_sock Commit 51e547e8c89c (\u0022tcp: Free TCP-AO/TCP-MD5 info/keys without RCU\u0022) removed the call_rcu() callback from tcp_ao_destroy_sock(), arguing that \u0022the destruction of info/keys is delayed until the socket destructor\u0022 and therefore \u0022no one can discover it anymore\u0022. That argument does not hold for the call site in tcp_connect() (net/ipv4/tcp_output.c:4327-4332). At that point the socket is in TCP_SYN_SENT, has already been inserted into the inet ehash by inet_hash_connect() in tcp_v4_connect(), and is therefore very much discoverable: any softirq running tcp_v4_rcv() on another CPU can take the socket out of the ehash, walk into tcp_inbound_hash(), and load tp-\u003Eao_info via implicit RCU before bh_lock_sock_nested() is taken on the destroying CPU. The reader path then enters __tcp_ao_do_lookup() (net/ipv4/tcp_ao.c:208) which re-loads tp-\u003Eao_info via rcu_dereference_check(); the re-load can still observe the (about-to-be-freed) pointer because there is no synchronize_rcu() between rcu_assign_pointer(tp-\u003Eao_info, NULL) and tcp_ao_info_free() in tcp_ao_destroy_sock(). The captured pointer is then walked at line 223: \thlist_for_each_entry_rcu(key, \u0026ao-\u003Ehead, node, ...) The writer\u0027s synchronous kfree() is free to complete between the line 218 re-fetch and the line 223 hlist iteration. The slab is reused (or simply LIST_POISON1-stamped if not yet reused) and the iteration walks attacker-controlled or poison memory in softirq context. Reproducer (no debug shim, stock x86_64 v7.1-rc2 SMP\u002BKASAN, QEMU\u002BKVM): an unprivileged uid=1000 process inside CLONE_NEWUSER|CLONE_NEWNET installs TCP_MD5SIG \u002B TCP_AO_ADD_KEY on a TCP socket, sprays forged TCP-AO segments toward its eventual 4-tuple via raw sockets, then calls connect(). The md5-wins reconciliation in tcp_connect() fires tcp_ao_destroy_sock(); the softirq backlog reader on the loopback NAPI path crashes on the freed ao-\u003Ehead.first walk: Oops: general protection fault, probably for non-canonical address 0xfbd59c000000002f KASAN: maybe wild-memory-access in range [0xdead000000000178-0xdead00000000017f] CPU: 0 UID: 1000 PID: 100 Comm: repro_userns RIP: 0010:__tcp_ao_do_lookup\u002B0x107/0x1c0 Call Trace: \u003CIRQ\u003E __tcp_ao_do_lookup\u002B0x107/0x1c0 tcp_ao_inbound_lookup.constprop.0\u002B0x12a/0x200 tcp_inbound_ao_hash\u002B0x5ea/0x1520 tcp_inbound_hash\u002B0x7ce/0x1240 tcp_v4_rcv\u002B0x1e7a/0x3e10 ... Restore the RCU grace period: re-add struct rcu_head to tcp_ao_info and replace the synchronous tcp_ao_info_free() with a call_rcu() callback. Readers that captured tp-\u003Eao_info before rcu_assign_pointer NULLed it now see the object remain valid until rcu_read_unlock(). With the patch applied the reproducer runs cleanly for 2000 iterations on the same kernel build.", "published": "2026-07-25T10:17:31Z", "severity": "critical", "cvss": 9.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "epss": 0.00649, "epssPercentile": 0.51387, "priority": "Urgent", "priorityTier": 2, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "bpftool6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "bpftool6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel-livepatch-6.18.39-79.141", "release": "amzn 2023", "fixedVersion": "1:1.0-0.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-aarch64", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-x86_64", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-headers", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra-common", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "7.1.4-1", "fix": "DEBIAN-CVE-2026-64459", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64459", "released": "2026-08-07T15:22:10Z" }, { "platform": "linux", "product": "microvm-kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "python3-perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" }, { "platform": "linux", "product": "python3-perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.39-79.141.amzn2023", "fix": "ALAS2023-2026-2045", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045", "released": "2026-08-03T09:00:00Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T06:59:42Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }