The vulnerability in the Linux kernel involves improper handling of the RCU grace period in the tcp_ao_destroy_sock() function. A commit removed the call_rcu() callback, assuming the TCP-AO keys would only be freed during socket destruction, which is not the case during tcp_connect() when the socket is still discoverable. This leads to a use-after-free scenario where a softirq running tcp_v4_rcv() can access freed TCP-AO key memory, causing kernel crashes. The patch restores the RCU grace period by re-adding the call_rcu() callback, ensuring that readers accessing tp->ao_info see a valid object until RCU read-side critical sections complete. The vulnerability can be triggered by an unprivileged process in user and network namespaces by installing TCP_MD5SIG and TCP_AO keys and sending forged TCP-AO segments, causing a general protection fault and potential denial of service.

The vulnerability can cause kernel crashes (general protection faults) due to use-after-free memory access in the TCP-AO key handling code. This can lead to denial of service on affected systems. There is no indication of privilege escalation or remote code execution from the provided data. The issue can be triggered by unprivileged users in certain namespace configurations, potentially allowing local denial of service.

A fix has been implemented in the Linux kernel by restoring the RCU grace period in tcp_ao_destroy_sock() via a call_rcu() callback. Systems should apply the official kernel patch that reintroduces this fix. Since no vendor advisory or patch links are provided, check the Linux kernel mailing lists or official repositories for the patch identified by commit 51e547e8c89c. Until patched, avoid untrusted local users installing TCP-AO keys or manipulating TCP connections in network namespaces.