The Linux kernel's tcp_ao_delete_key() function had a use-after-free vulnerability in its asynchronous key deletion path. Unlike the synchronous path, the asynchronous path did not validate current_key and rnext_key pointers, assuming they were NULL on LISTEN sockets. However, if keys were added while the socket was in CLOSE state and then transitioned to LISTEN, these pointers could be non-NULL. When such keys were deleted asynchronously, the memory was freed without clearing these pointers, leading to use-after-free when getsockopt(TCP_AO_INFO) accessed them. The vulnerability was fixed by clearing current_key and rnext_key pointers when deleting keys asynchronously.

This vulnerability allows a use-after-free condition in the Linux kernel TCP AO implementation, which could lead to kernel memory corruption or crashes when getsockopt(TCP_AO_INFO) is called on affected sockets. The specific impact depends on how the freed memory is accessed, but it could potentially be leveraged for denial of service or other kernel-level instability.

A fix has been implemented in the Linux kernel to clear dangling pointers in the asynchronous key deletion path of tcp_ao_delete_key(). Users should apply the official Linux kernel updates that include this fix. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended mitigation. Patch status is not yet confirmed in this data — check the vendor advisory for current remediation guidance.